Malware Analysis Report

2024-11-16 12:15

Sample ID 230714-cxz6bscg4x
Target 8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7
SHA256 8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7

Threat Level: Known bad

The file 8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7 was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Modifies boot configuration data using bcdedit

Renames multiple (474) files with added filename extension

Deletes shadow copies

Deletes backup catalog

Modifies Windows Firewall

Drops startup file

Reads user/profile data of web browsers

Checks computer location settings

Drops desktop.ini file(s)

Adds Run key to start application

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Unsigned PE

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Modifies registry class

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-14 02:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-14 02:28

Reported

2023-07-14 02:30

Platform

win10v2004-20230703-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (474) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7 = "C:\\Users\\Admin\\AppData\\Local\\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe" C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7 = "C:\\Users\\Admin\\AppData\\Local\\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe" C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1722984668-1829624581-3022101259-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1722984668-1829624581-3022101259-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-20_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Paint3D.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\COPYRIGHT.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\23.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\clrcompression.dll C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising.winmd C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\ui-strings.js C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\msointlimm.dll C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-400.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-400.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\sunjce_provider.jar C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\ui-strings.js C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_contrast-white.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page2.jpg C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\7.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls\EndOfLife\Assets\farewell.jpg C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Stable.msix.DATA C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-20.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-125.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\plugin.jar.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEEXCL.DLL.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\el_get.svg C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.id[67B60071-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3296 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\system32\cmd.exe
PID 3296 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\system32\cmd.exe
PID 3296 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\system32\cmd.exe
PID 3296 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\system32\cmd.exe
PID 944 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 944 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4192 wrote to memory of 4212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4192 wrote to memory of 4212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 944 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 944 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4192 wrote to memory of 4548 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4192 wrote to memory of 4548 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4192 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4192 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4192 wrote to memory of 4808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4192 wrote to memory of 4808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4192 wrote to memory of 4140 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4192 wrote to memory of 4140 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3296 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\SysWOW64\mshta.exe
PID 3296 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\system32\cmd.exe
PID 3296 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe C:\Windows\system32\cmd.exe
PID 4156 wrote to memory of 2148 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4156 wrote to memory of 2148 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4156 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4156 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4156 wrote to memory of 232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4156 wrote to memory of 232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4156 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4156 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4156 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4156 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe

"C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe"

C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe

"C:\Users\Admin\AppData\Local\Temp\8113218903975b81b22049796f201e06638595d2f6fadd82da06817bfbce85d7.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 924 -ip 924

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 484

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 254.134.241.8.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 58.189.79.40.in-addr.arpa udp

Files

memory/3296-134-0x0000000000610000-0x0000000000710000-memory.dmp

memory/3296-135-0x0000000000570000-0x000000000057F000-memory.dmp

memory/3296-136-0x0000000000400000-0x000000000049E000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[67B60071-3483].[[email protected]].8base

MD5 5e89c796c37b3772c99c1a4d858874bc
SHA1 ca1bc02f96ed93941146dfcb56d51e9b3f4fd95f
SHA256 52c3c1b40582796f28e22d72ccc114cd085e23bf046effcc8cac7cba9320d733
SHA512 409c209833110b633c04825f00a851e9121fdfc1ea73ade3ac48d40d5d1de77994d3eb4fbae15fe384674b9107fa6788d3bb7beb8ec48b83b1892d2c1b184366

memory/3296-345-0x0000000000610000-0x0000000000710000-memory.dmp

memory/3296-470-0x0000000000570000-0x000000000057F000-memory.dmp

memory/3296-713-0x0000000000400000-0x000000000049E000-memory.dmp

memory/3296-791-0x0000000000400000-0x000000000049E000-memory.dmp

memory/924-799-0x0000000000790000-0x0000000000890000-memory.dmp

memory/924-800-0x0000000000400000-0x000000000049E000-memory.dmp

memory/3296-3191-0x0000000000400000-0x000000000049E000-memory.dmp

memory/3296-4967-0x0000000000400000-0x000000000049E000-memory.dmp

memory/3296-6036-0x0000000000400000-0x000000000049E000-memory.dmp

memory/3296-8890-0x0000000000400000-0x000000000049E000-memory.dmp

memory/3296-11802-0x0000000000400000-0x000000000049E000-memory.dmp

C:\info.hta

MD5 97114c76039bfdf0a57e5045e1f0f017
SHA1 e46f66a36a39ad591cd0f13a5db0d97eaa2a696a
SHA256 d0d13e589043480e033b3014c64d6f0ef8119ade4026cab4a5d3022b3e26fd93
SHA512 874c7f4ef0bd9cc3320136336a23fbefb9a45dd6bf13c5929a5d9fbc4e03a2f9ba579a81b51b0a8973ef9a0c8b0c45f415387303f97b1c219b65ba4d230eaf11

C:\Users\Admin\Desktop\info.hta

MD5 97114c76039bfdf0a57e5045e1f0f017
SHA1 e46f66a36a39ad591cd0f13a5db0d97eaa2a696a
SHA256 d0d13e589043480e033b3014c64d6f0ef8119ade4026cab4a5d3022b3e26fd93
SHA512 874c7f4ef0bd9cc3320136336a23fbefb9a45dd6bf13c5929a5d9fbc4e03a2f9ba579a81b51b0a8973ef9a0c8b0c45f415387303f97b1c219b65ba4d230eaf11

C:\users\public\desktop\info.hta

MD5 97114c76039bfdf0a57e5045e1f0f017
SHA1 e46f66a36a39ad591cd0f13a5db0d97eaa2a696a
SHA256 d0d13e589043480e033b3014c64d6f0ef8119ade4026cab4a5d3022b3e26fd93
SHA512 874c7f4ef0bd9cc3320136336a23fbefb9a45dd6bf13c5929a5d9fbc4e03a2f9ba579a81b51b0a8973ef9a0c8b0c45f415387303f97b1c219b65ba4d230eaf11

C:\info.hta

MD5 97114c76039bfdf0a57e5045e1f0f017
SHA1 e46f66a36a39ad591cd0f13a5db0d97eaa2a696a
SHA256 d0d13e589043480e033b3014c64d6f0ef8119ade4026cab4a5d3022b3e26fd93
SHA512 874c7f4ef0bd9cc3320136336a23fbefb9a45dd6bf13c5929a5d9fbc4e03a2f9ba579a81b51b0a8973ef9a0c8b0c45f415387303f97b1c219b65ba4d230eaf11

F:\info.hta

MD5 97114c76039bfdf0a57e5045e1f0f017
SHA1 e46f66a36a39ad591cd0f13a5db0d97eaa2a696a
SHA256 d0d13e589043480e033b3014c64d6f0ef8119ade4026cab4a5d3022b3e26fd93
SHA512 874c7f4ef0bd9cc3320136336a23fbefb9a45dd6bf13c5929a5d9fbc4e03a2f9ba579a81b51b0a8973ef9a0c8b0c45f415387303f97b1c219b65ba4d230eaf11

memory/3296-12068-0x0000000000400000-0x000000000049E000-memory.dmp