Malware Analysis Report

2024-10-23 17:55

Sample ID 210910-s2qepaacf5
Target 6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb
SHA256 6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb
Tags
servhelper xmrig backdoor miner persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb

Threat Level: Known bad

The file 6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb was found to be: Known bad.

Malicious Activity Summary

servhelper xmrig backdoor miner persistence trojan

ServHelper

xmrig

Grants admin privileges

Sets DLL path for service in the registry

Modifies RDP port number used by Windows

Drops file in System32 directory

Drops file in Windows directory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Runs net.exe

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-10 15:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-10 15:37

Reported

2021-09-10 15:40

Platform

win10-en

Max time kernel

87s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe"

Signatures

ServHelper

trojan backdoor servhelper

xmrig

miner xmrig

Grants admin privileges

Modifies RDP port number used by Windows

Sets DLL path for service in the registry

persistence

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rdpclip.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\branding\mediasrv.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasvc.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\wupsvc.jpg C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\Basebrd C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\ShellBrd C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasrv.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasvc.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\wupsvc.jpg C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs net.exe

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4684 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 4984 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4796 wrote to memory of 4984 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4796 wrote to memory of 4984 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4984 wrote to memory of 5012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4984 wrote to memory of 5012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4984 wrote to memory of 5012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4796 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 3336 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 3336 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 3336 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 2652 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 2652 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 2652 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 4440 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 4440 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 4440 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 3056 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 3056 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 3056 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 4220 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 4220 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 4220 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 4796 wrote to memory of 4596 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\net.exe
PID 4796 wrote to memory of 4596 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\net.exe
PID 4796 wrote to memory of 4596 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\net.exe
PID 4596 wrote to memory of 2824 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4596 wrote to memory of 2824 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4596 wrote to memory of 2824 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4796 wrote to memory of 2628 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 2628 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 2628 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2628 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2628 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2628 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4136 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4136 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4136 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 3636 wrote to memory of 648 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3636 wrote to memory of 648 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3636 wrote to memory of 648 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4796 wrote to memory of 1016 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 1016 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 1016 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4636 wrote to memory of 4376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4636 wrote to memory of 4376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4636 wrote to memory of 4376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4376 wrote to memory of 3932 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4376 wrote to memory of 3932 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4376 wrote to memory of 3932 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4796 wrote to memory of 5032 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 5032 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 5032 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 5036 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 5036 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 5036 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe

"C:\Users\Admin\AppData\Local\Temp\6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rlmeisxk\rlmeisxk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7F7.tmp" "c:\Users\Admin\AppData\Local\Temp\rlmeisxk\CSC4A66E73C306D4AD9B2C12ABD8513448.TMP"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr

C:\Windows\SysWOW64\cmd.exe

cmd /c net start rdpdr

C:\Windows\SysWOW64\net.exe

net start rdpdr

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start rdpdr

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService

C:\Windows\SysWOW64\cmd.exe

cmd /c net start TermService

C:\Windows\SysWOW64\net.exe

net start TermService

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f

Network

Files

memory/4684-115-0x0000000005C80000-0x000000000607F000-memory.dmp

memory/4684-117-0x0000000006580000-0x0000000006581000-memory.dmp

memory/4684-118-0x0000000006220000-0x0000000006221000-memory.dmp

memory/4684-119-0x0000000005860000-0x0000000005861000-memory.dmp

memory/4684-120-0x0000000005862000-0x0000000005863000-memory.dmp

memory/4684-121-0x0000000005863000-0x0000000005864000-memory.dmp

memory/4684-122-0x00000000061A0000-0x00000000061A1000-memory.dmp

memory/4684-123-0x0000000008650000-0x0000000008651000-memory.dmp

memory/4684-124-0x0000000005864000-0x0000000005865000-memory.dmp

memory/4796-125-0x0000000000000000-mapping.dmp

memory/4796-128-0x0000000005220000-0x0000000005221000-memory.dmp

memory/4796-129-0x0000000007920000-0x0000000007921000-memory.dmp

memory/4796-130-0x0000000007F50000-0x0000000007F51000-memory.dmp

memory/4796-131-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

memory/4796-133-0x00000000082C0000-0x00000000082C1000-memory.dmp

memory/4796-134-0x00000000080F0000-0x00000000080F1000-memory.dmp

memory/4796-135-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

memory/4796-136-0x00000000051D0000-0x00000000051D1000-memory.dmp

memory/4796-137-0x00000000051D2000-0x00000000051D3000-memory.dmp

memory/4796-138-0x0000000008A10000-0x0000000008A11000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5 28d9755addec05c0b24cca50dfe3a92b
SHA1 7d3156f11c7a7fb60d29809caf93101de2681aa3
SHA256 abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9
SHA512 891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

memory/4796-144-0x0000000009E30000-0x0000000009E31000-memory.dmp

memory/4796-145-0x0000000009700000-0x0000000009701000-memory.dmp

memory/4984-146-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\rlmeisxk\rlmeisxk.cmdline

MD5 e27f848a662a392c72a76b090be8846d
SHA1 ccfc9b963da1c36e00756123ea8a78c84215ebb9
SHA256 7d3c4bcf16a95172c96964deb50c25473665b713980bb5baa999e3f1d0cb819d
SHA512 746ccaa59dbdd0606d8c46cf438f4c5f405eaccc5ca611efca9f597c7b191ded79d1755e673cc923524f89174ee5a6d5b259e28ce6dc168bf605e9e879c28b28

\??\c:\Users\Admin\AppData\Local\Temp\rlmeisxk\rlmeisxk.0.cs

MD5 9f8ab7eb0ab21443a2fe06dab341510e
SHA1 2b88b3116a79e48bab7114e18c9b9674e8a52165
SHA256 e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9
SHA512 53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

memory/5012-149-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\rlmeisxk\CSC4A66E73C306D4AD9B2C12ABD8513448.TMP

MD5 c38dfb364176fbc3900dc74e060b3d59
SHA1 65e77d4a5cad3daefeb7bfadef1f7f7b41c60fbb
SHA256 765e9d00180d92f7cab7f9f61ecef00b61346875831ec208c3fa96de10e1d4f7
SHA512 5671ab9d2a78a494f8c878e3014ccb0cb80c72893322cbd7d27f55106f1bceab4feedbfe918e6de33d46726fd741569b0694f8320209de97d76aa6ffcd338a5a

C:\Users\Admin\AppData\Local\Temp\RESF7F7.tmp

MD5 74b775dde5b64a7073a63fba3710daf7
SHA1 0cbde7105a33057d98c757ec2889060f42dc20b9
SHA256 e1068b626c575132b600f0ff37d184c1e66eced103e5fa000c8699a5d21fa3d3
SHA512 593361c6424364475d1845efaf0ef5a9e63c0c874bf2de598877587c32b1743f49810a5668ecabe747bbd9c169df2d28054a9802766fe1ade65df9391bb4c773

C:\Users\Admin\AppData\Local\Temp\rlmeisxk\rlmeisxk.dll

MD5 f3a97dfa37559f866f4642a4334fb6a3
SHA1 24887b46412ae12ba79a904dce03fc2f3227da8b
SHA256 61b59c8db4f80ad053d17cf3a12de540fbe26bcbbac52526e271eaccf8abac19
SHA512 b897e95feb66819c7543a94a6e8cd79c24bf9db252935edba2be0090d159b2dc44d4f07ed79db50cdfb9ebeb7b5c6726680e245cfc00de4504d70dd237f73c1f

memory/4796-153-0x0000000009790000-0x0000000009791000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5 30303b0cc1d6833b7dc84fbb907822be
SHA1 caaa99bb9a56a6974ba16fce6e01f4f95016b9f5
SHA256 91b6b2284e42eb7bdf6371fcbaf1724027fc600cd9bb56ed81f2f7d8c784f617
SHA512 117cb2e2c687d2cca1c069151df4c085dcb4a88e51b1f17b8b0e2f9ce1adf181ed76b8cc1c262bee45e34d7a8b513d5bf19a50f394064cf5c132fec23a6fb7da

memory/4796-155-0x00000000051D3000-0x00000000051D4000-memory.dmp

memory/4796-176-0x0000000009B00000-0x0000000009B01000-memory.dmp

memory/1836-177-0x0000000000000000-mapping.dmp

memory/1836-187-0x0000000004D42000-0x0000000004D43000-memory.dmp

memory/1836-186-0x0000000004D40000-0x0000000004D41000-memory.dmp

memory/1836-198-0x0000000008CE0000-0x0000000008D13000-memory.dmp

memory/1836-206-0x0000000008CC0000-0x0000000008CC1000-memory.dmp

memory/1836-207-0x000000007EBD0000-0x000000007EBD1000-memory.dmp

memory/1836-212-0x0000000008E10000-0x0000000008E11000-memory.dmp

memory/1836-213-0x0000000008FE0000-0x0000000008FE1000-memory.dmp

memory/1836-406-0x0000000008EF0000-0x0000000008EF1000-memory.dmp

memory/1836-412-0x0000000008EE0000-0x0000000008EE1000-memory.dmp

memory/3336-432-0x0000000000000000-mapping.dmp

memory/3336-441-0x00000000071E0000-0x00000000071E1000-memory.dmp

memory/3336-442-0x00000000071E2000-0x00000000071E3000-memory.dmp

memory/3336-467-0x000000007EAF0000-0x000000007EAF1000-memory.dmp

memory/2652-683-0x0000000000000000-mapping.dmp

memory/2652-696-0x0000000004F70000-0x0000000004F71000-memory.dmp

memory/2652-697-0x0000000004F72000-0x0000000004F73000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 f3068198b62b4b70404ec46694d632be
SHA1 7b0b31ae227cf2a78cb751573a9d07f755104ea0
SHA256 bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8
SHA512 ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

memory/2652-792-0x000000007FA90000-0x000000007FA91000-memory.dmp

memory/4440-962-0x0000000000000000-mapping.dmp

memory/3056-963-0x0000000000000000-mapping.dmp

memory/4220-964-0x0000000000000000-mapping.dmp

memory/4596-1001-0x0000000000000000-mapping.dmp

memory/2824-1002-0x0000000000000000-mapping.dmp

memory/2628-1005-0x0000000000000000-mapping.dmp

memory/4136-1006-0x0000000000000000-mapping.dmp

memory/3636-1007-0x0000000000000000-mapping.dmp

memory/648-1008-0x0000000000000000-mapping.dmp

memory/1016-1009-0x0000000000000000-mapping.dmp

memory/4636-1010-0x0000000000000000-mapping.dmp

memory/4376-1011-0x0000000000000000-mapping.dmp

memory/3932-1012-0x0000000000000000-mapping.dmp

memory/5032-1025-0x0000000000000000-mapping.dmp

memory/5036-1026-0x0000000000000000-mapping.dmp

memory/4796-1126-0x000000007EF40000-0x000000007EF41000-memory.dmp