Malware Analysis Report

2024-10-16 03:29

Sample ID 210901-2e4bpfje66
Target mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
SHA256 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
Tags
darkside ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4

Threat Level: Known bad

The file mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe was found to be: Known bad.

Malicious Activity Summary

darkside ransomware

DarkSide

Modifies extensions of user files

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in System32 directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of WriteProcessMemory

Modifies Control Panel

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-01 03:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-01 03:28

Reported

2021-09-01 03:30

Platform

win7v20210410

Max time kernel

9s

Max time network

15s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\02-cd-be-3d-b4-ab C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\International C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = d0cf38e8e19ed701 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-cd-be-3d-b4-ab\WpadDecisionReason = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-cd-be-3d-b4-ab\WpadDecision = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-cd-be-3d-b4-ab C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-cd-be-3d-b4-ab\WpadDecisionTime = d0cf38e8e19ed701 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon\ = "C:\\ProgramData\\949640ab.ico" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab\ = "949640ab" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1228 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 1228 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 1228 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 1228 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 1228 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 1932 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 1932 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 1932 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 1932 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

Processes

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe -work worker0 job0-1932

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 baroquetees.com udp

Files

memory/1100-60-0x00000000757D1000-0x00000000757D3000-memory.dmp

memory/1932-62-0x0000000000000000-mapping.dmp

memory/632-64-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-01 03:28

Reported

2021-09-01 03:30

Platform

win10v20210408

Max time kernel

21s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"

Signatures

DarkSide

ransomware darkside

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\StopUninstall.tif => C:\Users\Admin\Pictures\StopUninstall.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
File opened for modification C:\Users\Admin\Pictures\StopUninstall.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
File renamed C:\Users\Admin\Pictures\InstallProtect.tif => C:\Users\Admin\Pictures\InstallProtect.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
File opened for modification C:\Users\Admin\Pictures\InstallProtect.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\70d4d153.BMP" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 7b7b7c7a0b3d0e8932524cf201432e7ccd2750d0bc01722df26673eb9c2ae484 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5360d5572bbad45fc6c0db1b3adc0894f4dabb1dd24ca4bc208056e1782122bd C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 74eb7434d541c336a20a98d60bd1ce7998d75fa4d791d871efa0026f8da16e82 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = f40e0000978d60abf29ed701 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 95ac8196b0cadcb03a71f3e440980e4453da65d303119398dec90494e313081a C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\International C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d35604eeec4fc9673d555859b2c7db0601d78d317b0c8f386534ab0fa4c998e3 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 1bf7b9caf90a4ca4ee18e60be7b27c9c54fdbcb1c43631d8e54c275a92cb276a C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\70d4d153.BMP" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = f870630947ef5ba4ae2875519c907d1fe71280ef3f2088fb67b20bdc37acc6f8 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 88d8d7a9864c98a1d1d83fc786e2b4deee1828b36923de056cb8606ed75bae6c C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153\ = "70d4d153" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon\ = "C:\\ProgramData\\70d4d153.ico" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3940 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3940 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3940 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3940 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3704 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3704 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3704 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3704 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3704 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
PID 3704 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

Processes

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe -work worker0 job0-3704

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe -work worker1 job1-3704

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 baroquetees.com udp

Files

memory/3704-114-0x0000000000000000-mapping.dmp

memory/3828-115-0x0000000000000000-mapping.dmp

memory/2132-116-0x0000000000000000-mapping.dmp