Malware Analysis Report

2024-11-16 12:19

Sample ID 230715-gamzpsaa3y
Target d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4
SHA256 d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4
Tags
lumma phobos redline rhadamanthys smokeloader summ backdoor collection evasion infostealer persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4

Threat Level: Known bad

The file d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4 was found to be: Known bad.

Malicious Activity Summary

lumma phobos redline rhadamanthys smokeloader summ backdoor collection evasion infostealer persistence ransomware spyware stealer trojan

Detect rhadamanthys stealer shellcode

Lumma Stealer

Phobos

RedLine payload

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

SmokeLoader

RedLine

Renames multiple (332) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Modifies Windows Firewall

Deletes backup catalog

Downloads MZ/PE file

Reads user/profile data of web browsers

Executes dropped EXE

Deletes itself

Drops startup file

Drops desktop.ini file(s)

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Drops file in Program Files directory

Program crash

Unsigned PE

outlook_win_path

Uses Volume Shadow Copy service COM API

Suspicious behavior: MapViewOfSection

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Checks processor information in registry

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Checks SCSI registry key(s)

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-15 05:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-15 05:36

Reported

2023-07-15 05:38

Platform

win10-20230703-en

Max time kernel

129s

Max time network

157s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

Phobos

ransomware phobos

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4140 created 3288 N/A C:\Users\Admin\AppData\Local\Temp\12E7.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (332) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Hp_.exe C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hp_ = "C:\\Users\\Admin\\AppData\\Local\\Hp_.exe" C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hp_ = "C:\\Users\\Admin\\AppData\\Local\\Hp_.exe" C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-488886677-2269338296-1239465872-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-488886677-2269338296-1239465872-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-conio-l1-1-0.dll.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\PREVIEW.GIF C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEWDAT.DLL.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\msvcp140.dll C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.ELM C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sv.txt C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer.bat.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe.manifest.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\System.Spatial.dll C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-io.jar.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\plugin2\msvcr100.dll C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG2.TTF C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSI.TTF C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\flavormap.properties C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.id[99B458CC-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3288 wrote to memory of 4140 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\12E7.exe
PID 3288 wrote to memory of 4140 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\12E7.exe
PID 3288 wrote to memory of 4140 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\12E7.exe
PID 3288 wrote to memory of 1396 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\20A3.exe
PID 3288 wrote to memory of 1396 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\20A3.exe
PID 3288 wrote to memory of 1396 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\20A3.exe
PID 3288 wrote to memory of 4484 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\31DB.exe
PID 3288 wrote to memory of 4484 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\31DB.exe
PID 3288 wrote to memory of 4484 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\31DB.exe
PID 3288 wrote to memory of 5056 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 5056 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 5056 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 5056 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 4484 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\31DB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4484 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\31DB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4484 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\31DB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4484 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\31DB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4484 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\31DB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4484 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\31DB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4484 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\31DB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4484 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\31DB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3288 wrote to memory of 1416 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 1416 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 1416 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 4876 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4876 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4876 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4876 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4244 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 4244 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 4244 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 4316 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4316 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4316 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4316 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1548 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1548 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1548 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1548 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1664 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1664 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1664 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1664 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 1332 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 1332 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 1332 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3288 wrote to memory of 4156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3288 wrote to memory of 4156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 4140 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\12E7.exe C:\Windows\system32\certreq.exe
PID 4140 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\12E7.exe C:\Windows\system32\certreq.exe
PID 4140 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\12E7.exe C:\Windows\system32\certreq.exe
PID 4140 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\12E7.exe C:\Windows\system32\certreq.exe
PID 2108 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe
PID 2108 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe
PID 2108 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe
PID 2108 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe
PID 2108 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe
PID 2108 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe
PID 3760 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe C:\Windows\system32\cmd.exe
PID 3760 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe C:\Windows\system32\cmd.exe
PID 3760 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe C:\Windows\system32\cmd.exe
PID 3760 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe C:\Windows\system32\cmd.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4.exe

"C:\Users\Admin\AppData\Local\Temp\d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4.exe"

C:\Users\Admin\AppData\Local\Temp\12E7.exe

C:\Users\Admin\AppData\Local\Temp\12E7.exe

C:\Users\Admin\AppData\Local\Temp\20A3.exe

C:\Users\Admin\AppData\Local\Temp\20A3.exe

C:\Users\Admin\AppData\Local\Temp\31DB.exe

C:\Users\Admin\AppData\Local\Temp\31DB.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 844

C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe

"C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe"

C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe

"C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe"

C:\Users\Admin\AppData\Local\Microsoft\J7jA3tF.exe

"C:\Users\Admin\AppData\Local\Microsoft\J7jA3tF.exe"

C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe

"C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe"

C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe

"C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\7161.exe

C:\Users\Admin\AppData\Local\Temp\7161.exe

C:\Users\Admin\AppData\Local\Temp\73B3.exe

C:\Users\Admin\AppData\Local\Temp\73B3.exe

C:\Users\Admin\AppData\Local\Temp\7EA1.exe

C:\Users\Admin\AppData\Local\Temp\7EA1.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 360

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 stalagmijesarl.com udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 31.153.50.194.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 admxlogs25.xyz udp
EE 46.36.218.224:80 admxlogs25.xyz tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 224.218.36.46.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 github.com udp
US 140.82.114.4:443 github.com tcp
US 8.8.8.8:53 4.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
RU 185.106.93.193:48563 tcp
US 8.8.8.8:53 193.93.106.185.in-addr.arpa udp
US 8.8.8.8:53 gstatic-node.io udp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 admlogs195.xyz udp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 3.219.36.46.in-addr.arpa udp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 188.114.96.0:80 gstatic-node.io tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 188.114.96.0:80 gstatic-node.io tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 188.114.96.0:80 gstatic-node.io tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 9.57.101.20.in-addr.arpa udp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 serverxlogs21.xyz udp
DE 45.131.66.120:80 serverxlogs21.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 cexsad917.xyz udp
EE 46.36.218.224:80 cexsad917.xyz tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 liiala0j.beget.tech udp
RU 5.101.152.100:80 liiala0j.beget.tech tcp
US 8.8.8.8:53 100.152.101.5.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp
DE 45.131.66.120:80 serverxlogs21.xyz tcp
US 185.244.48.81:80 185.244.48.81 tcp
US 8.8.8.8:53 81.48.244.185.in-addr.arpa udp
US 8.8.8.8:53 221.74.101.95.in-addr.arpa udp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp

Files

memory/3028-118-0x0000000000570000-0x0000000000670000-memory.dmp

memory/3028-120-0x00000000001F0000-0x00000000001F9000-memory.dmp

memory/3028-119-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3028-121-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3028-123-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3288-122-0x0000000000BF0000-0x0000000000C06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\12E7.exe

MD5 11576ac18b5197c705e4282db22f0295
SHA1 2fbc5d63c8de05d5f1102a8066d5b394612128fc
SHA256 a81c88ad0eb4d2dfa7ea25b0326e1b1b8ffe630791647129f85312aeb50df207
SHA512 ce194dee6ad0e72e330dbd817c9dc8b93b9e5bc7fac9f3e3d8395268b2f5b9f98de97fa83f864cae4e943f94b2cf7980bd7ad34130e2413e17d2c46937112d65

C:\Users\Admin\AppData\Local\Temp\12E7.exe

MD5 11576ac18b5197c705e4282db22f0295
SHA1 2fbc5d63c8de05d5f1102a8066d5b394612128fc
SHA256 a81c88ad0eb4d2dfa7ea25b0326e1b1b8ffe630791647129f85312aeb50df207
SHA512 ce194dee6ad0e72e330dbd817c9dc8b93b9e5bc7fac9f3e3d8395268b2f5b9f98de97fa83f864cae4e943f94b2cf7980bd7ad34130e2413e17d2c46937112d65

memory/3288-139-0x00000000045E0000-0x00000000045F0000-memory.dmp

memory/3288-140-0x00000000045E0000-0x00000000045F0000-memory.dmp

memory/3288-142-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-144-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-145-0x0000000004BF0000-0x0000000004C00000-memory.dmp

memory/3288-147-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-149-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-150-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-152-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-151-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-154-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-156-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-158-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-159-0x0000000004C50000-0x0000000004C60000-memory.dmp

memory/3288-161-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-163-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-164-0x0000000004C50000-0x0000000004C60000-memory.dmp

memory/3288-166-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-170-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-177-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\20A3.exe

MD5 6d35d4cb11e99f8645441b0f1f96da3d
SHA1 3b6e12da0c1c37d38db867ab6330ace34461c56a
SHA256 9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204
SHA512 01b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4

memory/3288-179-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-180-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\20A3.exe

MD5 6d35d4cb11e99f8645441b0f1f96da3d
SHA1 3b6e12da0c1c37d38db867ab6330ace34461c56a
SHA256 9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204
SHA512 01b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4

memory/3288-182-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

memory/3288-184-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-186-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-168-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-187-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-190-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-191-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

memory/3288-188-0x0000000004C50000-0x0000000004C60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31DB.exe

MD5 8047a497e1d058891cf88476939901a2
SHA1 cbf28b0ee0cefdd2539882f46833e7da48a66c77
SHA256 c3762d5a1108134bc8750cb8baea4584f7459e17a76276b22620d36d625cfcbb
SHA512 e73ec40abd75452361e47381e82240678aa1436c0da3d86abeb880fbee7ddd15d28ab27bd8bc13ef3a61d185380f5b2f0b04189cb65042383c5240ad31cfa262

C:\Users\Admin\AppData\Local\Temp\31DB.exe

MD5 8047a497e1d058891cf88476939901a2
SHA1 cbf28b0ee0cefdd2539882f46833e7da48a66c77
SHA256 c3762d5a1108134bc8750cb8baea4584f7459e17a76276b22620d36d625cfcbb
SHA512 e73ec40abd75452361e47381e82240678aa1436c0da3d86abeb880fbee7ddd15d28ab27bd8bc13ef3a61d185380f5b2f0b04189cb65042383c5240ad31cfa262

memory/4940-197-0x0000000000400000-0x000000000045A000-memory.dmp

memory/5056-198-0x00000000026B0000-0x00000000026BB000-memory.dmp

memory/5056-199-0x00000000026C0000-0x00000000026C7000-memory.dmp

memory/5056-200-0x00000000026B0000-0x00000000026BB000-memory.dmp

memory/4940-201-0x0000000072510000-0x0000000072BFE000-memory.dmp

memory/4940-202-0x0000000007B60000-0x000000000805E000-memory.dmp

memory/4940-203-0x0000000007740000-0x00000000077D2000-memory.dmp

memory/1416-204-0x0000000000DA0000-0x0000000000DAF000-memory.dmp

memory/1416-205-0x0000000000DB0000-0x0000000000DB9000-memory.dmp

memory/4940-208-0x0000000007710000-0x000000000771A000-memory.dmp

memory/3288-207-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

memory/1416-206-0x0000000000DA0000-0x0000000000DAF000-memory.dmp

memory/4940-209-0x00000000076D0000-0x00000000076E0000-memory.dmp

memory/4940-210-0x0000000008670000-0x0000000008C76000-memory.dmp

memory/4940-211-0x0000000007920000-0x0000000007932000-memory.dmp

memory/4940-212-0x0000000008060000-0x000000000816A000-memory.dmp

memory/4876-213-0x0000000002FB0000-0x0000000002FB9000-memory.dmp

memory/4940-215-0x00000000079A0000-0x00000000079DE000-memory.dmp

memory/4876-216-0x0000000002FB0000-0x0000000002FB9000-memory.dmp

memory/4876-214-0x0000000002FC0000-0x0000000002FC5000-memory.dmp

memory/4940-217-0x00000000079E0000-0x0000000007A2B000-memory.dmp

memory/4244-218-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

memory/4244-219-0x0000000002FB0000-0x0000000002FB9000-memory.dmp

memory/4244-220-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

memory/4140-221-0x0000000002120000-0x0000000002191000-memory.dmp

memory/4140-222-0x0000000000590000-0x0000000000690000-memory.dmp

memory/4140-223-0x0000000000400000-0x0000000000517000-memory.dmp

memory/4316-224-0x0000000002FA0000-0x0000000002FC7000-memory.dmp

memory/5056-225-0x00000000026C0000-0x00000000026C7000-memory.dmp

memory/4316-227-0x0000000002FA0000-0x0000000002FC7000-memory.dmp

memory/4316-226-0x0000000000400000-0x0000000000517000-memory.dmp

memory/4940-229-0x0000000072510000-0x0000000072BFE000-memory.dmp

memory/1548-228-0x0000000003240000-0x0000000003249000-memory.dmp

memory/1416-230-0x0000000000DB0000-0x0000000000DB9000-memory.dmp

memory/1548-231-0x0000000002FA0000-0x0000000002FC7000-memory.dmp

memory/1548-232-0x0000000003240000-0x0000000003249000-memory.dmp

memory/4140-234-0x0000000002490000-0x0000000002890000-memory.dmp

memory/4140-233-0x00000000021B0000-0x00000000021B7000-memory.dmp

memory/4940-235-0x00000000076D0000-0x00000000076E0000-memory.dmp

memory/4140-236-0x0000000002490000-0x0000000002890000-memory.dmp

memory/4140-237-0x0000000002490000-0x0000000002890000-memory.dmp

memory/4876-238-0x0000000002FC0000-0x0000000002FC5000-memory.dmp

memory/4140-239-0x0000000002490000-0x0000000002890000-memory.dmp

memory/1664-241-0x0000000002790000-0x000000000279B000-memory.dmp

memory/1664-242-0x0000000002790000-0x000000000279B000-memory.dmp

memory/4940-243-0x00000000081E0000-0x0000000008246000-memory.dmp

memory/1332-244-0x00000000010A0000-0x00000000010AD000-memory.dmp

memory/4244-245-0x0000000002FB0000-0x0000000002FB9000-memory.dmp

memory/4140-246-0x0000000002120000-0x0000000002191000-memory.dmp

memory/1332-247-0x0000000002790000-0x000000000279B000-memory.dmp

memory/1332-248-0x00000000010A0000-0x00000000010AD000-memory.dmp

memory/4156-257-0x0000000000110000-0x000000000011B000-memory.dmp

memory/1020-263-0x000002B194D60000-0x000002B194D63000-memory.dmp

memory/4140-268-0x00000000031D0000-0x0000000003206000-memory.dmp

memory/4140-275-0x00000000031D0000-0x0000000003206000-memory.dmp

memory/4140-279-0x0000000000400000-0x0000000000517000-memory.dmp

memory/1396-281-0x0000000000400000-0x0000000000502000-memory.dmp

memory/1020-286-0x000002B194D60000-0x000002B194D63000-memory.dmp

memory/1020-289-0x000002B196E00000-0x000002B196E07000-memory.dmp

memory/1020-290-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-291-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-292-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-293-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-299-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-300-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-301-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-304-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-306-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-307-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

memory/1020-308-0x00007FF7315C0000-0x00007FF7316ED000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe

MD5 7d39a3778ad4a5d5e6c7e78fc9e05a00
SHA1 2b030e3180efb06721404fa0de1fbe4998618225
SHA256 21a3bdc28c80ad2f590418c95fa8ff8c21f2e8b80166c7dea43ddc70c16bfaf9
SHA512 1a0693245d226de50eacd2c8ae0081cea3c20e8b9f6f0f0dff69468aba294c402fba321920129346528bc1d5512e6db31f551f049b95177add129dae6148cc2e

C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe

MD5 7d39a3778ad4a5d5e6c7e78fc9e05a00
SHA1 2b030e3180efb06721404fa0de1fbe4998618225
SHA256 21a3bdc28c80ad2f590418c95fa8ff8c21f2e8b80166c7dea43ddc70c16bfaf9
SHA512 1a0693245d226de50eacd2c8ae0081cea3c20e8b9f6f0f0dff69468aba294c402fba321920129346528bc1d5512e6db31f551f049b95177add129dae6148cc2e

C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3

C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3

C:\Users\Admin\AppData\Local\Microsoft\J7jA3tF.exe

MD5 5e11dd2bc2627a60f664e37c36e735a7
SHA1 550d348ea3f28ba8a0e67675775e26de282fc51f
SHA256 204e68df323cbcabdd60a878fa5444df2ddd1fbaa8411d6350649e4a2e233434
SHA512 5eef7950796c878b368871463cab0f79899b13b0649c38ee36b6630b55ab15b04b5859e833285965fd394eaab846eb09773733529f02b8f2606c1e59f7afe8fe

C:\Users\Admin\AppData\Local\Microsoft\J7jA3tF.exe

MD5 5e11dd2bc2627a60f664e37c36e735a7
SHA1 550d348ea3f28ba8a0e67675775e26de282fc51f
SHA256 204e68df323cbcabdd60a878fa5444df2ddd1fbaa8411d6350649e4a2e233434
SHA512 5eef7950796c878b368871463cab0f79899b13b0649c38ee36b6630b55ab15b04b5859e833285965fd394eaab846eb09773733529f02b8f2606c1e59f7afe8fe

C:\Users\Admin\AppData\Local\Microsoft\11y`Y2vU6.exe

MD5 7d39a3778ad4a5d5e6c7e78fc9e05a00
SHA1 2b030e3180efb06721404fa0de1fbe4998618225
SHA256 21a3bdc28c80ad2f590418c95fa8ff8c21f2e8b80166c7dea43ddc70c16bfaf9
SHA512 1a0693245d226de50eacd2c8ae0081cea3c20e8b9f6f0f0dff69468aba294c402fba321920129346528bc1d5512e6db31f551f049b95177add129dae6148cc2e

C:\Users\Admin\AppData\Local\Microsoft\Hp_.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[99B458CC-3483].[[email protected]].8base

MD5 684767b84fdd857e5aa51eae7ca4632e
SHA1 f3eb06cee2b05a102a01add94baae4827d6e6557
SHA256 4882e53d5b3378dcf16cbb504a709fe1af2afe1a95c6bb00f3d8e0e5715b2366
SHA512 ef6fcfc14c6fb4c0bb6244bfd87889b79e79d12bf444dc8e76b63c6c9a489c8e4fa08fa27b535c5e9d4200accdf2dd9a240d096ad529e0c08422030c2d132baf

C:\Users\Admin\AppData\Local\Temp\7161.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3

C:\Users\Admin\AppData\Local\Temp\7161.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3

C:\Users\Admin\AppData\Local\Temp\7161.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3

C:\Users\Admin\AppData\Local\Temp\73B3.exe

MD5 5e11dd2bc2627a60f664e37c36e735a7
SHA1 550d348ea3f28ba8a0e67675775e26de282fc51f
SHA256 204e68df323cbcabdd60a878fa5444df2ddd1fbaa8411d6350649e4a2e233434
SHA512 5eef7950796c878b368871463cab0f79899b13b0649c38ee36b6630b55ab15b04b5859e833285965fd394eaab846eb09773733529f02b8f2606c1e59f7afe8fe

C:\Users\Admin\AppData\Local\Temp\73B3.exe

MD5 5e11dd2bc2627a60f664e37c36e735a7
SHA1 550d348ea3f28ba8a0e67675775e26de282fc51f
SHA256 204e68df323cbcabdd60a878fa5444df2ddd1fbaa8411d6350649e4a2e233434
SHA512 5eef7950796c878b368871463cab0f79899b13b0649c38ee36b6630b55ab15b04b5859e833285965fd394eaab846eb09773733529f02b8f2606c1e59f7afe8fe

C:\Users\Admin\AppData\Local\Temp\7EA1.exe

MD5 4a9777a2bf4fa6e8945a0b48dfac8108
SHA1 36777152e87eb30a58e4b22430888ee0b065864e
SHA256 67e2316b799a36c92f468f339002f1b3e1c2a984c1fbff5a73f0659a13209ad8
SHA512 ddc703fbcf4909e65395a5911404c08991c03d234295d4e24484d92648e6b2e8a99fdafd8851b45e29d77c0e8aba0a4b0fc0c709ebbdee9939712fcc476a897a

C:\Users\Admin\AppData\Local\Temp\7EA1.exe

MD5 4a9777a2bf4fa6e8945a0b48dfac8108
SHA1 36777152e87eb30a58e4b22430888ee0b065864e
SHA256 67e2316b799a36c92f468f339002f1b3e1c2a984c1fbff5a73f0659a13209ad8
SHA512 ddc703fbcf4909e65395a5911404c08991c03d234295d4e24484d92648e6b2e8a99fdafd8851b45e29d77c0e8aba0a4b0fc0c709ebbdee9939712fcc476a897a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q2ft4sxy.default-release\cookies.sqlite.id[99B458CC-3483].[[email protected]].8base

MD5 d64ea3dafb92dbdcbbe21d75a0e03b38
SHA1 3d673c19e3d3e10f20dc9a49c2618f0e320c2bb0
SHA256 d15a63b03b300aeab0913c1fb3bb68865a82af90515bc654a4d4f7f83f229dd7
SHA512 30392c6b5adcddae885d75e8f2785c247633bc8131d1259e9ad2da03e767774f2d4ae87a0ca25ec76299c9affb518b27c180227b022df43c11ad73b4563ef597

C:\ProgramData\EHJKKKFI

MD5 463c1926a90e1c8a31cfec7afff4aefb
SHA1 caacc7f0749cc95e72fb2f69c579ee2779d2e331
SHA256 7ad5746f6ec7a87c5c4b706f7bea273808022ebe36fc5f59dacfd58e83fe9f7b
SHA512 e916336ea6d7046597cbea785eb7f6edd699c48ea9de9042b05635927d18b24c445478bcc03f805f408922daa101247edc6e5b09a7f63bfc372d4e72a8ffaf98

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\ProgramData\freebl3.dll

MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\ProgramData\Files.docx

MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\nss3.dll

MD5 8306662968087ccde2ebe51f0d49fa5b
SHA1 2f195093ef1287197917c93d4a821e27caec916e
SHA256 ecb31d0e963f7b1d397e82d21f10e8a2cc9c93730d245fa7d90d5b5f59395fe3
SHA512 f3cc80a1898a36d3ec76d057c816130815bd1dfa0776538239f02785a33c0586ff9b90fa5f4a68a89887b5c597838d8ee7031171b80029499f36d131b761e789

C:\ProgramData\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

C:\ProgramData\vcruntime140.dll

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

MD5 fdda262fd864570c443577cf5c351ab7
SHA1 f05ac15b1741dcf4f0337615a2908fa851ff2176
SHA256 22b428b8cc1171aebc27035d22151d8275db339da0729ba427e7ecca652929d8
SHA512 bc5dd99ee71ba9ca2a098cb4352f9b47a0bcb0842f918e6fa4c46b641fb1face8a507c88a90d536ebeb293fb1b2f3c1f4caa999cf4e1ac49cf5a7b97ada59117

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db.id[99B458CC-3483].[[email protected]].8base

MD5 39be458ce43b4b941ee9cae75637a16e
SHA1 baf4ec5bfb8cc6d636e16c9331565beb58a8c529
SHA256 c2223a8ca7cb790a6daa6321344065f385e19653eaa369ed81c0a2cd9c395618
SHA512 0a3297890b42612a1b9ab2d8698261b264ff712b37a929d4afcde0021d7266b60714ddcccba22d25e91c6f879fb73bd578d2a6af9dc1dbb7c4bafcd439581480

C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

MD5 7f510ff434bc8f430780428889cf48fd
SHA1 aa2bd0da0dcb40d302a559e7543a6ba5a86014f5
SHA256 b3a3482a9243d624566603998e298a78003a4e5c018ff65f7f88467a0d255a7c
SHA512 b370ff1e5d21f86b37736f95e4b8957b3bca81942a0877537c891b12a05bea13dda6bfa6b1ab9c08155e4f877e1047337cd512639d2e1744a2196cd82ae05f06

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\1I05F2K8.cookie

MD5 472f5fe0d86a9d0ab5c676c922c0d48b
SHA1 2eba122bff1672cfe41152e497a0f2b86679f5c7
SHA256 595622eea3a69fa018b7213821fbad54b84676b70f7bcb5b5e34bb56d918005a
SHA512 4b36ec420af396bc3582af686987df4e6e0fec984b1c96282c1cf6f2a79c948954601f7e59918f5e248989ecc7a84ea525e7b89232a24848dec6f873adeafafa

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletLockScreenLogo.scale-200.png

MD5 541abea8b402b4ddd7463b2cd1bf54ec
SHA1 e0bfa993adcc35d6cc955be49c2f952529660ad5
SHA256 d436906bb661ba5d0ae3ad2d949b709f92bf50eb79a9faedd7f66d5598e07f16
SHA512 b22478881f719ac94392ef43dbf553c4644e2b3676191cb35c7bd212f496978e5b4e15869d254b96a393314a30e2ce397a6d6bf44cac45a2eff38d997b40c7f6

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe

MD5 a4bd1ce8b5026e59037a3903cd6e4e3a
SHA1 352243b758a585cf869cd9f9354cd302463f4d9d
SHA256 39d69cd43e452c4899dbf1aa5b847c2a2d251fb8e13df9232ebdb5f0fdc3594c
SHA512 c86901a1bdcebc5721743fca6ac7f1909b64518e046752f3b412183db940563c088e0ec12613ad0b763c814bc3b6bf99dd3b6f8a6bce54add30a10d29e38400c

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~es-ES~10.0.15063.0.mum

MD5 ac62b24ee1c94ba09ff3b85bba930bf2
SHA1 9a9aa17c629d9e2dc09078764f59f081f69bebab
SHA256 a044c0e9036e355cc530e88831cbbe60165477929d0f838c786a513937ff1628
SHA512 1168537c3a9b92c8534434f8cf68a3d4d95a48086beb194c68519db9b65f3f57706a678bb7accf085b9f121c069a8c1fae78a1a64df853fb039a761efebf130d

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~es-ES~10.0.15063.0.cat

MD5 463a0532986607cb1ad6b26e94153c05
SHA1 9aa5b80581530693c1f3cb32a1e107532a2a1a96
SHA256 e07a11415f11c98fa5d6e8fb8baa515be4fd071d3528910273efcbec9e882075
SHA512 a004a39ec97d816f7e2f43cd4b1bd52acbdbc5f358a5bfe6d997bfed223af2b9a9653fee8fb57e0d4ed11135802a49b85a8286a8119996a4ed88c78f641b1f80

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.mum

MD5 741bc0bd78e3693cb950954aa1bf2e52
SHA1 bd322ece9153b51214eda41bba0c6b803d6caa30
SHA256 a349648c7ac60c4711585d09d0c9012f2c8b96077ccaf957c672b34a05c5ad8d
SHA512 b6dd9a8b794ee35fe99f04f5d78b2168157e3fed76752a98b8a39cc5c567ec23581b5c348da6e149ab28ea0cb89c0c0d0f08545174f01ba9d45a860a4eb73b7c

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat

MD5 be70c63aeccef9f4c5175a8741b13b69
SHA1 c5ef2591b7f1df2ecbca40219d2513d516825e9a
SHA256 d648d365d08a7c503edc75535a58f15b865f082b49355254d539a41bf3af87ff
SHA512 b93bf53a5c71a587df7b59fdcaf8046c47e5d82838666ca12e6f56e26c0b9223edf7bf3dbb9352d5718486c531e34a060a05d7924896ab3b6d370dd4ef262186

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~de-DE~10.0.15063.0.mum

MD5 f82f048efc3466bd287ecaa6f5a2d679
SHA1 9eedd9499deae645ffe402eb50361e83def12f14
SHA256 e35cd2ee9eae753175b9b88e032d4973672ff5677b9b7b79eaff1839e0c3044c
SHA512 5cc7337eebc480c482d56a8a5a2c788daa5c4e0370dc33d612caf59c65757cfa7cfc3cbb3321a7e01c6bb97e827962c4d156cfa661ea0b230a43e67940c81230

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~de-DE~10.0.15063.0.cat

MD5 6523a368322f50d964b00962f74b3f65
SHA1 5f360ae5b5b5e76f390e839cf1b440333506e4e8
SHA256 652687424e20a2d6c16ea15ae653150467cfae4993d5ca28dc30106ff8a0ca67
SHA512 210737efc4e2775f261b0dc00ca1ad2aa1a7630633688c5bb9190fa5ff791e9757bbae190f4f7e931f8a4c7e4acf1effce479fdafd3952777ee40d08bdf1c046

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe

MD5 a4bd1ce8b5026e59037a3903cd6e4e3a
SHA1 352243b758a585cf869cd9f9354cd302463f4d9d
SHA256 39d69cd43e452c4899dbf1aa5b847c2a2d251fb8e13df9232ebdb5f0fdc3594c
SHA512 c86901a1bdcebc5721743fca6ac7f1909b64518e046752f3b412183db940563c088e0ec12613ad0b763c814bc3b6bf99dd3b6f8a6bce54add30a10d29e38400c

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll

MD5 49ba729dd7ad347eb8ad44dcc3f20de4
SHA1 36bfc3b216daa23e7c3a1e89df88ca533ad878d1
SHA256 88fd9d7794d1e0549facf9534da6abcb3db4be57e2fd045f678b621f7f5a6f3d
SHA512 c7a6750d34e85534fdf3be543a12340de9623ed7c094b9f8f8dd8e7f7308406e5ee90fe7b3c147b170ed67948bb875f72ad5035ecde3f608843fa74d19f9bf0b

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletWide310x150Logo.scale-200.png

MD5 52bf805c4241200c576401a59f9e211a
SHA1 a10074a87d7c244fcee9b8d45005673aa48140a1
SHA256 adee2dfff644b55f272b54cd8742e886a2bb21623c4f1e6b3058ccf97588d87c
SHA512 9142a45cc68422a51e84ad58858409e7fe711cd120565f0d36d3e7b3f7e9a771e83549d9d852f708a41a511fc0a1989a0315b141ddc122b014f533b0466ad688

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletStoreLogo.png

MD5 08de9d6a366fb174872e8043e2384099
SHA1 955114d06eefae5e498797f361493ee607676d95
SHA256 0289105cf9484cf5427630866c0525b60f6193dea0afacd0224f997ce8103861
SHA512 59004a4920d5e3b80b642c285ff649a2ee5c52df25b6209be46d2f927a9c2ab170534ea0819c7c70292534ee08eb90e36630d11da18edba502776fac42872ed0

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare44x44Logo.targetsize-24_altform-unplated.png

MD5 2bb84fb822fe6ed44bf10bbf31122308
SHA1 e9049ca6522a736d75fc85b3b16a0ad0dc271334
SHA256 afb6768acc7e2229c7566d68dabf863bafdb8d59e2cca45f39370fc7261965dc
SHA512 1f24ca0e934881760a94c1f90d31ef6ccbab165d39c0155fb83b31e92abe4e5e3b70f49189f75d8cdd859796a55312f27c71fda0b8296e8cf30167a02d7391f5

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare44x44Logo.scale-200.png

MD5 1572efa3e47162a7b2198893a362b803
SHA1 a291f6f1cae15d03d5ef0f748b83bee024aa2fca
SHA256 d39fb03894ed83d57acf16976ae256c9912bd7e9feb63cb5c85709e1617e90dc
SHA512 4267d64626b808e9b338d973335794a5b3c3586c26fb0d11c96b07c2ad551486150449d83d5ae2756451c32365a8877a0c59592e5b173a27142464787de7ff45

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare150x150Logo.scale-200.png

MD5 0262d1daca4c1c1e22dec63b012e3641
SHA1 609258b00f17f2a9dd586fe5a7e485573ef477c9
SHA256 8b0ccafcace92ee624e057fa91550d306efd5dc21bb0c850c174ef38d79754fc
SHA512 a1ad7e32bfabfa4ecf32be9ab96db5c84ecf48a8b8a6e267cb106281e119669fed0fb12eaea024e21aa2f13de8f14fa0b805f869b53ec85524b60dc1db7743d0

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSplashScreen.png

MD5 52bf805c4241200c576401a59f9e211a
SHA1 a10074a87d7c244fcee9b8d45005673aa48140a1
SHA256 adee2dfff644b55f272b54cd8742e886a2bb21623c4f1e6b3058ccf97588d87c
SHA512 9142a45cc68422a51e84ad58858409e7fe711cd120565f0d36d3e7b3f7e9a771e83549d9d852f708a41a511fc0a1989a0315b141ddc122b014f533b0466ad688

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletLockScreenLogo.scale-200.png

MD5 541abea8b402b4ddd7463b2cd1bf54ec
SHA1 e0bfa993adcc35d6cc955be49c2f952529660ad5
SHA256 d436906bb661ba5d0ae3ad2d949b709f92bf50eb79a9faedd7f66d5598e07f16
SHA512 b22478881f719ac94392ef43dbf553c4644e2b3676191cb35c7bd212f496978e5b4e15869d254b96a393314a30e2ce397a6d6bf44cac45a2eff38d997b40c7f6

C:\Users\Admin\AppData\Local\Temp\AA50\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml

MD5 44628eb64853341f7678ec488959efe2
SHA1 60e37cb04f7941b6070d3ce035af3d434c78fbfd
SHA256 f44e196695dffbc9442ab694343447097b8362fccaf4269057890f39da50df2e
SHA512 0134c598e3ada0a5ae47c9803b1c0f248d88a92c5fd79dd2baea7dea82322ff52f8b218be41bd3b72f270fe170ad36df5106d2f21ca51be5f8f3c6791da9d86f

C:\Users\Admin\AppData\Local\Temp\AA50\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml

MD5 5b333e85c957925ec5f7ae9c47872020
SHA1 97431745824321574e6e6c9666e79147b5a6ea67
SHA256 c2c28b18a9bbe65c7f29640ec18d5836fa51ce720b336dc6e44d49ff2d807d08
SHA512 377b42d7a432c597cbf41c5c9f4303592f88a3fef368e53532ec1474529d5d915f264ca1f099c269a4d4bc35fea22d35140d45c099f4fdb66be8cb109b533f80

C:\Users\Admin\AppData\Local\Temp\AA50\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml

MD5 44628eb64853341f7678ec488959efe2
SHA1 60e37cb04f7941b6070d3ce035af3d434c78fbfd
SHA256 f44e196695dffbc9442ab694343447097b8362fccaf4269057890f39da50df2e
SHA512 0134c598e3ada0a5ae47c9803b1c0f248d88a92c5fd79dd2baea7dea82322ff52f8b218be41bd3b72f270fe170ad36df5106d2f21ca51be5f8f3c6791da9d86f

C:\Users\Admin\AppData\Local\Temp\AA50\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml

MD5 5b333e85c957925ec5f7ae9c47872020
SHA1 97431745824321574e6e6c9666e79147b5a6ea67
SHA256 c2c28b18a9bbe65c7f29640ec18d5836fa51ce720b336dc6e44d49ff2d807d08
SHA512 377b42d7a432c597cbf41c5c9f4303592f88a3fef368e53532ec1474529d5d915f264ca1f099c269a4d4bc35fea22d35140d45c099f4fdb66be8cb109b533f80

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletWide310x150Logo.scale-200.png

MD5 52bf805c4241200c576401a59f9e211a
SHA1 a10074a87d7c244fcee9b8d45005673aa48140a1
SHA256 adee2dfff644b55f272b54cd8742e886a2bb21623c4f1e6b3058ccf97588d87c
SHA512 9142a45cc68422a51e84ad58858409e7fe711cd120565f0d36d3e7b3f7e9a771e83549d9d852f708a41a511fc0a1989a0315b141ddc122b014f533b0466ad688

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletStoreLogo.png

MD5 08de9d6a366fb174872e8043e2384099
SHA1 955114d06eefae5e498797f361493ee607676d95
SHA256 0289105cf9484cf5427630866c0525b60f6193dea0afacd0224f997ce8103861
SHA512 59004a4920d5e3b80b642c285ff649a2ee5c52df25b6209be46d2f927a9c2ab170534ea0819c7c70292534ee08eb90e36630d11da18edba502776fac42872ed0

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare44x44Logo.targetsize-24_altform-unplated.png

MD5 2bb84fb822fe6ed44bf10bbf31122308
SHA1 e9049ca6522a736d75fc85b3b16a0ad0dc271334
SHA256 afb6768acc7e2229c7566d68dabf863bafdb8d59e2cca45f39370fc7261965dc
SHA512 1f24ca0e934881760a94c1f90d31ef6ccbab165d39c0155fb83b31e92abe4e5e3b70f49189f75d8cdd859796a55312f27c71fda0b8296e8cf30167a02d7391f5

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare44x44Logo.scale-200.png

MD5 1572efa3e47162a7b2198893a362b803
SHA1 a291f6f1cae15d03d5ef0f748b83bee024aa2fca
SHA256 d39fb03894ed83d57acf16976ae256c9912bd7e9feb63cb5c85709e1617e90dc
SHA512 4267d64626b808e9b338d973335794a5b3c3586c26fb0d11c96b07c2ad551486150449d83d5ae2756451c32365a8877a0c59592e5b173a27142464787de7ff45

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare150x150Logo.scale-200.png

MD5 0262d1daca4c1c1e22dec63b012e3641
SHA1 609258b00f17f2a9dd586fe5a7e485573ef477c9
SHA256 8b0ccafcace92ee624e057fa91550d306efd5dc21bb0c850c174ef38d79754fc
SHA512 a1ad7e32bfabfa4ecf32be9ab96db5c84ecf48a8b8a6e267cb106281e119669fed0fb12eaea024e21aa2f13de8f14fa0b805f869b53ec85524b60dc1db7743d0

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSplashScreen.png

MD5 52bf805c4241200c576401a59f9e211a
SHA1 a10074a87d7c244fcee9b8d45005673aa48140a1
SHA256 adee2dfff644b55f272b54cd8742e886a2bb21623c4f1e6b3058ccf97588d87c
SHA512 9142a45cc68422a51e84ad58858409e7fe711cd120565f0d36d3e7b3f7e9a771e83549d9d852f708a41a511fc0a1989a0315b141ddc122b014f533b0466ad688

C:\Users\Admin\AppData\Local\Temp\AA50\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.Background.winmd

MD5 64d3f93322e5e6932ad162365441301d
SHA1 832e1b6e6560f8dae2b8282b72a1d80545ea5891
SHA256 df52db081c34a78391d85832bcb2190a9417fb34e468d5f15e84ac1916a085cc
SHA512 86b8e1f699321c6eb187b597a08bdfdd4b47686681e495783b981ca82cfaaa8be22d1775143cfd0a6d3c7b381b419930609c8370e67a906eba9e1b6a5024eb20

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll

MD5 49ba729dd7ad347eb8ad44dcc3f20de4
SHA1 36bfc3b216daa23e7c3a1e89df88ca533ad878d1
SHA256 88fd9d7794d1e0549facf9534da6abcb3db4be57e2fd045f678b621f7f5a6f3d
SHA512 c7a6750d34e85534fdf3be543a12340de9623ed7c094b9f8f8dd8e7f7308406e5ee90fe7b3c147b170ed67948bb875f72ad5035ecde3f608843fa74d19f9bf0b

C:\Users\Admin\AppData\Local\Temp\AA50\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.Background.winmd

MD5 64d3f93322e5e6932ad162365441301d
SHA1 832e1b6e6560f8dae2b8282b72a1d80545ea5891
SHA256 df52db081c34a78391d85832bcb2190a9417fb34e468d5f15e84ac1916a085cc
SHA512 86b8e1f699321c6eb187b597a08bdfdd4b47686681e495783b981ca82cfaaa8be22d1775143cfd0a6d3c7b381b419930609c8370e67a906eba9e1b6a5024eb20

C:\info.hta

MD5 3fc23dd2391820f8295f532305d70916
SHA1 4427371b8a24feeadfedfb3fc7ade729e03c961c
SHA256 c913ab75ee5f8885677d6ca93b5b410b6276b090dd542a1b13f5ce4623ba9a5b
SHA512 e03475bd227e2802285afdabcbaafdf561b6ac06720e8a06a7882001cbed4ebb796d3335d103aa1d8e260b5e53847544e087d158424127e0083d6503e5eddec2