Malware Analysis Report

2024-11-16 12:19

Sample ID 230715-f6egrsaa2v
Target 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953

Threat Level: Known bad

The file 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953 was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Deletes shadow copies

Renames multiple (450) files with added filename extension

Modifies boot configuration data using bcdedit

Modifies Windows Firewall

Deletes backup catalog

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-15 05:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-15 05:28

Reported

2023-07-15 05:31

Platform

win10-20230703-en

Max time kernel

150s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (450) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953 = "C:\\Users\\Admin\\AppData\\Local\\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe" C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000\Software\Microsoft\Windows\CurrentVersion\Run\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953 = "C:\\Users\\Admin\\AppData\\Local\\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe" C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1766410430-2870137818-4067673745-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1766410430-2870137818-4067673745-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-localization-l1-2-0.dll.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\ui-strings.js.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\hmmapi.dll.mui C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\wordEtw.man.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\PREVIEW.GIF.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\angel.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-24.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\mlib_image.dll C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql120.xsl C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-It.otf C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\star.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msadomd.dll C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbytools.jar C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Strings\en-US\People-PDP-Content.xml C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\Microsoft.PowerShell.PackageManagement.resources.dll C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\chess.3mf C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\Density_Medium.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_cardback.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\pe_16x11.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter_18.svg C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Should.ps1 C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_audit_report_18.svg C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\mask\13h.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\SkypeAppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\JitV.dll C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\vcruntime140.dll C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif.id[D8084359-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2928 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\system32\cmd.exe
PID 2928 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\system32\cmd.exe
PID 2928 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\system32\cmd.exe
PID 2928 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\system32\cmd.exe
PID 3420 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3420 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 832 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 832 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3420 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3420 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 832 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 832 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 832 wrote to memory of 4048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 832 wrote to memory of 4048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 832 wrote to memory of 660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 832 wrote to memory of 660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 832 wrote to memory of 664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 832 wrote to memory of 664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2928 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\SysWOW64\mshta.exe
PID 2928 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\system32\cmd.exe
PID 2928 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe C:\Windows\system32\cmd.exe
PID 4192 wrote to memory of 4884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4192 wrote to memory of 4884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4192 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4192 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4192 wrote to memory of 3604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4192 wrote to memory of 3604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4192 wrote to memory of 3408 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4192 wrote to memory of 3408 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4192 wrote to memory of 760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4192 wrote to memory of 760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe

"C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe"

C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe

"C:\Users\Admin\AppData\Local\Temp\89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 203.151.224.20.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

memory/2928-118-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2928-119-0x0000000000620000-0x000000000062F000-memory.dmp

memory/2928-120-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2928-122-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[D8084359-3483].[[email protected]].8base

MD5 9534b33fa29807458fce890e7c0913e0
SHA1 bee6cdba2047325ecd1a504fceff24f4bc3363da
SHA256 42c1c36948a04204b574da9846aa652e8dcda6ac7b1db6667a73732bb2438463
SHA512 f570b3ba529141c0b2cc2cf5fe10452496f1a31b6bcc6bb9eb423ee1502f58526560f51447efc7d3895f18a5a2cff1ba3d0f0261af13afb5f3a4ead95b1077fd

memory/2928-550-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2928-1400-0x0000000000620000-0x000000000062F000-memory.dmp

memory/2240-1769-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2240-1777-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2928-1776-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2240-1780-0x00000000006F0000-0x00000000007F0000-memory.dmp

memory/2928-2193-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2928-4247-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2928-6023-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2928-8486-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\info.hta

MD5 c7a892784a172ac923300f617ea09bfa
SHA1 c76fb44b6709585f326c18288b4a1f9d3a6f268b
SHA256 0b8711790df1f19ea9503bf42be6469dccb671a37fd3b5041949c326e926f14d
SHA512 4ae61204844c6da85738a11c5b357379dbe4f294b7ed430f0e4e62235db41e46057f60c987dd6f3c4f4aa6917808582c0372839757d29dccd33a8da4d5cfb556

C:\users\public\desktop\info.hta

MD5 c7a892784a172ac923300f617ea09bfa
SHA1 c76fb44b6709585f326c18288b4a1f9d3a6f268b
SHA256 0b8711790df1f19ea9503bf42be6469dccb671a37fd3b5041949c326e926f14d
SHA512 4ae61204844c6da85738a11c5b357379dbe4f294b7ed430f0e4e62235db41e46057f60c987dd6f3c4f4aa6917808582c0372839757d29dccd33a8da4d5cfb556

C:\Users\Admin\Desktop\info.hta

MD5 c7a892784a172ac923300f617ea09bfa
SHA1 c76fb44b6709585f326c18288b4a1f9d3a6f268b
SHA256 0b8711790df1f19ea9503bf42be6469dccb671a37fd3b5041949c326e926f14d
SHA512 4ae61204844c6da85738a11c5b357379dbe4f294b7ed430f0e4e62235db41e46057f60c987dd6f3c4f4aa6917808582c0372839757d29dccd33a8da4d5cfb556

C:\info.hta

MD5 c7a892784a172ac923300f617ea09bfa
SHA1 c76fb44b6709585f326c18288b4a1f9d3a6f268b
SHA256 0b8711790df1f19ea9503bf42be6469dccb671a37fd3b5041949c326e926f14d
SHA512 4ae61204844c6da85738a11c5b357379dbe4f294b7ed430f0e4e62235db41e46057f60c987dd6f3c4f4aa6917808582c0372839757d29dccd33a8da4d5cfb556

F:\info.hta

MD5 c7a892784a172ac923300f617ea09bfa
SHA1 c76fb44b6709585f326c18288b4a1f9d3a6f268b
SHA256 0b8711790df1f19ea9503bf42be6469dccb671a37fd3b5041949c326e926f14d
SHA512 4ae61204844c6da85738a11c5b357379dbe4f294b7ed430f0e4e62235db41e46057f60c987dd6f3c4f4aa6917808582c0372839757d29dccd33a8da4d5cfb556

memory/2928-12187-0x0000000000400000-0x00000000004E3000-memory.dmp