Malware Analysis Report

2024-10-16 05:11

Sample ID 230917-lj59vsbf25
Target ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
SHA256 ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6
Tags
ammyyadmin phobos rhadamanthys smokeloader backdoor collection evasion persistence ransomware rat spyware stealer trojan flawedammyy bootkit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6

Threat Level: Known bad

The file ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin phobos rhadamanthys smokeloader backdoor collection evasion persistence ransomware rat spyware stealer trojan flawedammyy bootkit

Detect rhadamanthys stealer shellcode

Ammyy Admin

FlawedAmmyy RAT

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys

Phobos

AmmyyAdmin payload

SmokeLoader

Deletes shadow copies

Renames multiple (87) files with added filename extension

Modifies boot configuration data using bcdedit

Modifies Windows Firewall

Downloads MZ/PE file

Deletes backup catalog

Checks computer location settings

Executes dropped EXE

Drops startup file

Reads user/profile data of web browsers

Loads dropped DLL

Deletes itself

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Drops desktop.ini file(s)

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Uses Task Scheduler COM API

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

outlook_win_path

Interacts with shadow copies

Suspicious use of UnmapMainImage

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-17 09:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-17 09:34

Reported

2023-09-17 09:37

Platform

win7-20230831-en

Max time kernel

151s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2668 created 1192 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B6C1.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D089.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\m~3 = "C:\\Users\\Admin\\AppData\\Local\\m~3.exe" C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\m~3 = "C:\\Users\\Admin\\AppData\\Local\\m~3.exe" C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZLIB.ACCDE.id[5F393BF7-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZMAIN.ACCDE.id[5F393BF7-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE.id[5F393BF7-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\B6C1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D089.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2084 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 2668 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 2668 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 2668 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 2668 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 2668 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 2668 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1824 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Users\Admin\AppData\Local\Microsoft\m~3.exe
PID 1780 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe
PID 1780 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe
PID 1780 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe
PID 1780 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe
PID 1780 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe
PID 1780 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe
PID 1780 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe
PID 2684 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Microsoft\m~3.exe C:\Windows\system32\cmd.exe
PID 2444 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2444 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2444 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1584 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1584 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1584 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2444 wrote to memory of 3056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2444 wrote to memory of 3056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2444 wrote to memory of 3056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 840 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 840 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe

"C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe"

C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe

C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe

C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe

C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

"C:\Users\Admin\AppData\Local\Microsoft\m~3.exe"

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe

"C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe"

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

"C:\Users\Admin\AppData\Local\Microsoft\m~3.exe"

C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe

C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe

C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe

"C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\B6C1.exe

C:\Users\Admin\AppData\Local\Temp\B6C1.exe

C:\Users\Admin\AppData\Local\Temp\B6C1.exe

C:\Users\Admin\AppData\Local\Temp\B6C1.exe

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

C:\Users\Admin\AppData\Local\Temp\D089.exe

C:\Users\Admin\AppData\Local\Temp\D089.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\2E22.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\2E22.tmp\svchost.exe -debug

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\D089.exe

"C:\Users\Admin\AppData\Local\Temp\D089.exe"

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 serverxlogs21.xyz udp
US 8.8.8.8:53 servxblog79.xyz udp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 mkhexlogs215.xyz udp
DE 45.155.173.227:80 mkhexlogs215.xyz tcp
EE 5.45.127.232:80 servxblog79.xyz tcp

Files

memory/2084-0-0x0000000074600000-0x0000000074CEE000-memory.dmp

memory/2084-1-0x0000000000160000-0x00000000001DC000-memory.dmp

memory/2084-2-0x0000000004220000-0x0000000004298000-memory.dmp

memory/2084-3-0x0000000004C10000-0x0000000004C50000-memory.dmp

memory/2084-4-0x0000000004690000-0x00000000046F8000-memory.dmp

memory/2084-5-0x00000000002D0000-0x000000000031C000-memory.dmp

memory/2668-6-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-8-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-9-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2084-14-0x0000000074600000-0x0000000074CEE000-memory.dmp

memory/2668-15-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-16-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-17-0x0000000000140000-0x0000000000147000-memory.dmp

memory/2668-18-0x0000000001E40000-0x0000000002240000-memory.dmp

memory/2668-19-0x0000000001E40000-0x0000000002240000-memory.dmp

memory/2668-20-0x0000000001E40000-0x0000000002240000-memory.dmp

memory/2668-21-0x0000000001E40000-0x0000000002240000-memory.dmp

memory/2640-22-0x00000000000E0000-0x00000000000E3000-memory.dmp

memory/2640-23-0x00000000000E0000-0x00000000000E3000-memory.dmp

memory/2668-24-0x00000000003B0000-0x00000000003E6000-memory.dmp

memory/2668-30-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-32-0x0000000001E40000-0x0000000002240000-memory.dmp

memory/2668-31-0x00000000003B0000-0x00000000003E6000-memory.dmp

memory/2668-33-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2668-34-0x0000000001E40000-0x0000000002240000-memory.dmp

memory/2640-36-0x00000000001A0000-0x00000000001A7000-memory.dmp

memory/2640-38-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-37-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-39-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-40-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-42-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-44-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-45-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-46-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-47-0x0000000077400000-0x00000000775A9000-memory.dmp

memory/2640-48-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-49-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-50-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-51-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-52-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-53-0x0000000077400000-0x00000000775A9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/1824-59-0x0000000074480000-0x0000000074B6E000-memory.dmp

memory/1824-57-0x0000000001250000-0x00000000012A4000-memory.dmp

memory/1824-60-0x0000000000A20000-0x0000000000A66000-memory.dmp

memory/1824-61-0x0000000000C80000-0x0000000000CB4000-memory.dmp

memory/1824-62-0x0000000000A80000-0x0000000000AC0000-memory.dmp

memory/2684-63-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2684-65-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2684-67-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2684-69-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2684-68-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2684-70-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2684-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2684-73-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/2684-76-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1824-77-0x0000000074480000-0x0000000074B6E000-memory.dmp

memory/2684-78-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe

MD5 9138afd16b164d19ebd70be9151a813d
SHA1 ce5a099fb44e195044071d339f74b625e0c776a7
SHA256 c2d38ac7544ba201dc37b9ee4ff3bc94a6d7c8303dff9c2684aacada5369132b
SHA512 8da2d3f7c42bb0690cb1854aa592d1f86310aaacfa2820da860973045520aa96293436d935cb5f932faf72807b26353d4a1705839345769a477e160170284ca5

C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe

MD5 9138afd16b164d19ebd70be9151a813d
SHA1 ce5a099fb44e195044071d339f74b625e0c776a7
SHA256 c2d38ac7544ba201dc37b9ee4ff3bc94a6d7c8303dff9c2684aacada5369132b
SHA512 8da2d3f7c42bb0690cb1854aa592d1f86310aaacfa2820da860973045520aa96293436d935cb5f932faf72807b26353d4a1705839345769a477e160170284ca5

memory/1780-81-0x0000000000100000-0x0000000000152000-memory.dmp

memory/1780-82-0x00000000733B0000-0x0000000073A9E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/1780-85-0x00000000006B0000-0x00000000006F4000-memory.dmp

memory/1780-86-0x00000000004E0000-0x0000000000512000-memory.dmp

memory/1952-87-0x00000000733B0000-0x0000000073A9E000-memory.dmp

memory/1916-88-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1916-90-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1916-94-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\x7R`58.exe

MD5 9138afd16b164d19ebd70be9151a813d
SHA1 ce5a099fb44e195044071d339f74b625e0c776a7
SHA256 c2d38ac7544ba201dc37b9ee4ff3bc94a6d7c8303dff9c2684aacada5369132b
SHA512 8da2d3f7c42bb0690cb1854aa592d1f86310aaacfa2820da860973045520aa96293436d935cb5f932faf72807b26353d4a1705839345769a477e160170284ca5

memory/1916-92-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1916-96-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1952-98-0x0000000001250000-0x00000000012A4000-memory.dmp

memory/1780-97-0x00000000733B0000-0x0000000073A9E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

C:\Users\Admin\AppData\Local\Microsoft\8}kg.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

\Users\Admin\AppData\Local\Microsoft\8}kg.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

memory/840-102-0x0000000001170000-0x0000000001256000-memory.dmp

memory/840-103-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

memory/840-104-0x000000001BB80000-0x000000001BC62000-memory.dmp

memory/840-105-0x000000001BB00000-0x000000001BB80000-memory.dmp

memory/840-106-0x000000001BF40000-0x000000001C010000-memory.dmp

memory/2684-116-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2684-118-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1916-125-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2640-130-0x00000000001A0000-0x00000000001A2000-memory.dmp

memory/2640-131-0x0000000077400000-0x00000000775A9000-memory.dmp

memory/2684-137-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1952-154-0x00000000733B0000-0x0000000073A9E000-memory.dmp

memory/840-156-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

memory/840-157-0x000000001BB00000-0x000000001BB80000-memory.dmp

memory/840-161-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B6C1.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Temp\B6C1.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Temp\B6C1.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/2104-170-0x00000000733B0000-0x0000000073A9E000-memory.dmp

memory/2104-171-0x0000000000A00000-0x0000000000A54000-memory.dmp

memory/2104-172-0x0000000004BF0000-0x0000000004C30000-memory.dmp

\Users\Admin\AppData\Local\Temp\B6C1.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/1952-188-0x0000000004FB0000-0x0000000004FF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B6C1.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/2984-196-0x0000000000401000-0x000000000040A000-memory.dmp

memory/2104-198-0x00000000733B0000-0x0000000073A9E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\m~3.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/2596-208-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1952-209-0x00000000733B0000-0x0000000073A9E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D089.exe

MD5 23588d1443006c07e9a91c838cfceae6
SHA1 4d57bad257ba01d981986ba79635c5069b7325d5
SHA256 c601117ab09f58d2138630b2bff84ea1bbc2555aaa7e3e4633338924f1516450
SHA512 ca085a3f228e30d1c273d6970dc132a2a754ae1ba983f70dc2b272055f5634dd720f956558f0bc18dbe8441706b7c67cac619113f95c557d5239e27839b525c1

C:\Users\Admin\AppData\Local\Temp\D089.exe

MD5 23588d1443006c07e9a91c838cfceae6
SHA1 4d57bad257ba01d981986ba79635c5069b7325d5
SHA256 c601117ab09f58d2138630b2bff84ea1bbc2555aaa7e3e4633338924f1516450
SHA512 ca085a3f228e30d1c273d6970dc132a2a754ae1ba983f70dc2b272055f5634dd720f956558f0bc18dbe8441706b7c67cac619113f95c557d5239e27839b525c1

memory/2624-214-0x00000000742F0000-0x00000000749DE000-memory.dmp

memory/2624-215-0x0000000000B20000-0x0000000000B92000-memory.dmp

memory/1084-218-0x0000000000070000-0x0000000000077000-memory.dmp

memory/1084-219-0x0000000000060000-0x000000000006C000-memory.dmp

memory/2696-220-0x0000000000200000-0x0000000000275000-memory.dmp

memory/2696-222-0x00000000000F0000-0x000000000015B000-memory.dmp

memory/864-224-0x0000000000080000-0x0000000000089000-memory.dmp

memory/864-228-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2696-238-0x00000000000F0000-0x000000000015B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2E22.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\2E22.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\2E22.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\2E22.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\2E22.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\D089.exe

MD5 23588d1443006c07e9a91c838cfceae6
SHA1 4d57bad257ba01d981986ba79635c5069b7325d5
SHA256 c601117ab09f58d2138630b2bff84ea1bbc2555aaa7e3e4633338924f1516450
SHA512 ca085a3f228e30d1c273d6970dc132a2a754ae1ba983f70dc2b272055f5634dd720f956558f0bc18dbe8441706b7c67cac619113f95c557d5239e27839b525c1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dlwtx977.default-release\favicons.sqlite.id[5F393BF7-3483].[[email protected]].8base

MD5 3ee30e2c9e67a48d807f6698623cbd8a
SHA1 dd07ec105517471436bf1cac9f9be88895f0b4b8
SHA256 2e57d666f3bbfba103537a2918064ec9842328440b0fbb7e0f382eefd7435bd6
SHA512 a3b7cfcd99eb37513114733ace971d4a54cd409f204129061040413a51589c42ea4899dbbe63fdb3cb7410c61e029f6aabdb63d7dce7864bb7deaca1a1d7c705

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-17 09:34

Reported

2023-09-17 09:37

Platform

win10v2004-20230915-en

Max time kernel

151s

Max time network

156s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4560 created 2624 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (87) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\285E.tmp\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ey3%LS = "C:\\Users\\Admin\\AppData\\Local\\ey3%LS.exe" C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ey3%LS = "C:\\Users\\Admin\\AppData\\Local\\ey3%LS.exe" C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1574508946-349927670-1185736483-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1574508946-349927670-1185736483-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\285E.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\sawindbg.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\org-openide-util.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_LinkDrop32x32.gif C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\bin\server\Xusage.txt.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfxswt.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\bin\glib-lite.dll.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\bin\hprof.dll.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl.bat.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\fxplugins.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\msvcr120.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfont.properties.ja.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pl.jar.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\WindowsAccessBridge-64.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adojavas.inc C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\local_policy.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-ui.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\sunec.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\hprof.dll.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\resource.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\nio.dll.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_MoveNoDrop32x32.gif.id[21095B6C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\E9CE.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\E9CE.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\285E.tmp\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4224 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 4224 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 4224 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 4224 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 4224 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 4224 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 4224 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 4224 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe
PID 4560 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 4560 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 4560 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 4560 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe C:\Windows\system32\certreq.exe
PID 2764 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 2764 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 956 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe
PID 4568 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe
PID 4568 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe
PID 4568 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe
PID 4568 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe
PID 4568 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe
PID 4568 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe
PID 2468 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Windows\system32\cmd.exe
PID 2468 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Windows\system32\cmd.exe
PID 2468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Windows\system32\cmd.exe
PID 2468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe C:\Windows\system32\cmd.exe
PID 2864 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2864 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4516 wrote to memory of 3964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4516 wrote to memory of 3964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2864 wrote to memory of 1324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2864 wrote to memory of 1324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1600 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 1600 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 1600 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 4516 wrote to memory of 1888 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4516 wrote to memory of 1888 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1600 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 1600 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe

"C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe"

C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe

C:\Users\Admin\AppData\Local\Temp\ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6_JC.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

"C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe"

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

"C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe"

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe

"C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe"

C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe

"C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe"

C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe

C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RBvfugTGdvfZCHCgvSoHZdsYt2u1JwYhUP.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Users\Admin\AppData\Local\Temp\EB95.exe

C:\Users\Admin\AppData\Local\Temp\EB95.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

"C:\Users\Admin\AppData\Local\Temp\E9CE.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\285E.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\285E.tmp\svchost.exe -debug

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
NL 141.98.6.38:39001 tcp
US 8.8.8.8:53 38.6.98.141.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
US 8.8.8.8:53 serverxlogs21.xyz udp
US 8.8.8.8:53 servxblog79.xyz udp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 mkhexlogs215.xyz udp
DE 45.155.173.227:80 mkhexlogs215.xyz tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 232.127.45.5.in-addr.arpa udp
US 8.8.8.8:53 227.173.155.45.in-addr.arpa udp
US 8.8.8.8:53 rx.unmineable.com udp
US 165.227.182.82:3333 rx.unmineable.com tcp
US 8.8.8.8:53 82.182.227.165.in-addr.arpa udp
EE 5.45.127.232:80 servxblog79.xyz tcp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 204.201.50.20.in-addr.arpa udp

Files

memory/4224-0-0x0000000074A80000-0x0000000075230000-memory.dmp

memory/4224-1-0x0000000000050000-0x00000000000CC000-memory.dmp

memory/4224-2-0x0000000004FA0000-0x0000000005544000-memory.dmp

memory/4224-3-0x0000000004AA0000-0x0000000004B18000-memory.dmp

memory/4224-4-0x0000000000C00000-0x0000000000C10000-memory.dmp

memory/4224-5-0x0000000004B40000-0x0000000004BA8000-memory.dmp

memory/4224-6-0x0000000004BC0000-0x0000000004C0C000-memory.dmp

memory/4560-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4560-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4560-11-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4224-12-0x0000000074A80000-0x0000000075230000-memory.dmp

memory/4560-13-0x0000000001250000-0x0000000001257000-memory.dmp

memory/4560-14-0x0000000002EE0000-0x00000000032E0000-memory.dmp

memory/4560-15-0x0000000002EE0000-0x00000000032E0000-memory.dmp

memory/4560-16-0x0000000002EE0000-0x00000000032E0000-memory.dmp

memory/4560-17-0x0000000002EE0000-0x00000000032E0000-memory.dmp

memory/4560-18-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-19-0x000001C171930000-0x000001C171933000-memory.dmp

memory/4560-20-0x0000000003D20000-0x0000000003D56000-memory.dmp

memory/4560-26-0x0000000003D20000-0x0000000003D56000-memory.dmp

memory/4560-27-0x0000000002EE0000-0x00000000032E0000-memory.dmp

memory/4560-28-0x0000000002EE0000-0x00000000032E0000-memory.dmp

memory/4560-29-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4560-30-0x0000000002EE0000-0x00000000032E0000-memory.dmp

memory/3548-31-0x000001C171930000-0x000001C171933000-memory.dmp

memory/3548-32-0x000001C171AD0000-0x000001C171AD7000-memory.dmp

memory/3548-33-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-34-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-35-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-36-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-37-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-38-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-40-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-41-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-42-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-43-0x00007FFA43DF0000-0x00007FFA43FE5000-memory.dmp

memory/3548-44-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-45-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-46-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-47-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-48-0x00007FF488010000-0x00007FF48813F000-memory.dmp

memory/3548-49-0x00007FFA43DF0000-0x00007FFA43FE5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/2764-53-0x0000000000940000-0x0000000000994000-memory.dmp

memory/2764-54-0x0000000074A80000-0x0000000075230000-memory.dmp

memory/2764-55-0x0000000005230000-0x0000000005276000-memory.dmp

memory/2764-56-0x0000000005380000-0x0000000005390000-memory.dmp

memory/2764-57-0x00000000053A0000-0x00000000053D4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/2468-61-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/2468-65-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2764-67-0x0000000074A80000-0x0000000075230000-memory.dmp

memory/2468-66-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ey3%LS.exe.log

MD5 ff27e87d4bf1330435001e57e8244d60
SHA1 b22264ed3cd4d35f8236278edd2512c3b7ecb355
SHA256 7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e
SHA512 d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

memory/956-70-0x0000000074B20000-0x00000000752D0000-memory.dmp

memory/956-71-0x0000000004930000-0x0000000004940000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\ey3%LS.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/956-76-0x0000000074B20000-0x00000000752D0000-memory.dmp

memory/1164-77-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe

MD5 9138afd16b164d19ebd70be9151a813d
SHA1 ce5a099fb44e195044071d339f74b625e0c776a7
SHA256 c2d38ac7544ba201dc37b9ee4ff3bc94a6d7c8303dff9c2684aacada5369132b
SHA512 8da2d3f7c42bb0690cb1854aa592d1f86310aaacfa2820da860973045520aa96293436d935cb5f932faf72807b26353d4a1705839345769a477e160170284ca5

C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe

MD5 9138afd16b164d19ebd70be9151a813d
SHA1 ce5a099fb44e195044071d339f74b625e0c776a7
SHA256 c2d38ac7544ba201dc37b9ee4ff3bc94a6d7c8303dff9c2684aacada5369132b
SHA512 8da2d3f7c42bb0690cb1854aa592d1f86310aaacfa2820da860973045520aa96293436d935cb5f932faf72807b26353d4a1705839345769a477e160170284ca5

memory/4568-83-0x0000000074A80000-0x0000000075230000-memory.dmp

memory/4568-82-0x0000000000B00000-0x0000000000B52000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

C:\Users\Admin\AppData\Local\Microsoft\8B)V0AjseE.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

memory/4568-86-0x0000000005420000-0x0000000005464000-memory.dmp

memory/1600-87-0x0000024367D20000-0x0000024367E06000-memory.dmp

memory/4568-88-0x0000000005560000-0x0000000005592000-memory.dmp

memory/1600-89-0x00007FFA25530000-0x00007FFA25FF1000-memory.dmp

memory/4568-90-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/4308-91-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\7CHC298x85.exe

MD5 9138afd16b164d19ebd70be9151a813d
SHA1 ce5a099fb44e195044071d339f74b625e0c776a7
SHA256 c2d38ac7544ba201dc37b9ee4ff3bc94a6d7c8303dff9c2684aacada5369132b
SHA512 8da2d3f7c42bb0690cb1854aa592d1f86310aaacfa2820da860973045520aa96293436d935cb5f932faf72807b26353d4a1705839345769a477e160170284ca5

memory/4308-94-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1600-95-0x000002436A2A0000-0x000002436A382000-memory.dmp

memory/1600-97-0x000002436A3D0000-0x000002436A3E0000-memory.dmp

memory/4568-96-0x0000000074A80000-0x0000000075230000-memory.dmp

memory/1600-104-0x000002436A530000-0x000002436A600000-memory.dmp

memory/2468-109-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-110-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-111-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-113-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-117-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-128-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-121-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-167-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-132-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-118-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-116-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-207-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-172-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-165-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2468-197-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[21095B6C-3483].[[email protected]].8base

MD5 7d3ebb71e17c7b5906a7a1302a74d676
SHA1 1d4efa541b26fa917dee7b07440c86531dcc7a01
SHA256 3116b16e3a55d4c6bd7d911bb795c6aba7f2784c4af38486fe1ab4ca8bc3f0d9
SHA512 dff6097cd0f78bd6568ee418a6a7fdf409db39b1ffc207c4090dd9bcd3b26662d0d27d66076b021c513ff1bb4ecc1168e0b2cc13544f1dd607e9580156f1cb74

memory/3548-399-0x000001C171AD0000-0x000001C171AD5000-memory.dmp

memory/3548-404-0x00007FFA43DF0000-0x00007FFA43FE5000-memory.dmp

memory/4308-449-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1600-461-0x00007FFA25530000-0x00007FFA25FF1000-memory.dmp

memory/624-520-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/624-525-0x00007FFA25530000-0x00007FFA25FF1000-memory.dmp

memory/624-530-0x0000020A747F0000-0x0000020A74800000-memory.dmp

memory/624-535-0x0000020A75090000-0x0000020A75192000-memory.dmp

memory/1600-540-0x00007FFA25530000-0x00007FFA25FF1000-memory.dmp

memory/624-672-0x0000020A72F50000-0x0000020A72F58000-memory.dmp

memory/624-674-0x0000020A75290000-0x0000020A752E6000-memory.dmp

memory/624-1077-0x0000020A747F0000-0x0000020A74800000-memory.dmp

memory/624-1749-0x00007FFA25530000-0x00007FFA25FF1000-memory.dmp

memory/624-1750-0x0000020A747F0000-0x0000020A74800000-memory.dmp

memory/624-1781-0x0000020A747F0000-0x0000020A74800000-memory.dmp

memory/624-2306-0x0000020A747F0000-0x0000020A74800000-memory.dmp

memory/2468-2336-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

memory/5100-2341-0x0000000074A80000-0x0000000075230000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EB95.exe

MD5 23588d1443006c07e9a91c838cfceae6
SHA1 4d57bad257ba01d981986ba79635c5069b7325d5
SHA256 c601117ab09f58d2138630b2bff84ea1bbc2555aaa7e3e4633338924f1516450
SHA512 ca085a3f228e30d1c273d6970dc132a2a754ae1ba983f70dc2b272055f5634dd720f956558f0bc18dbe8441706b7c67cac619113f95c557d5239e27839b525c1

C:\Users\Admin\AppData\Local\Temp\EB95.exe

MD5 23588d1443006c07e9a91c838cfceae6
SHA1 4d57bad257ba01d981986ba79635c5069b7325d5
SHA256 c601117ab09f58d2138630b2bff84ea1bbc2555aaa7e3e4633338924f1516450
SHA512 ca085a3f228e30d1c273d6970dc132a2a754ae1ba983f70dc2b272055f5634dd720f956558f0bc18dbe8441706b7c67cac619113f95c557d5239e27839b525c1

memory/5100-2345-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

memory/1428-2350-0x0000000000910000-0x0000000000982000-memory.dmp

memory/624-2349-0x0000020A747F0000-0x0000020A74800000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\E9CE.exe.log

MD5 ff27e87d4bf1330435001e57e8244d60
SHA1 b22264ed3cd4d35f8236278edd2512c3b7ecb355
SHA256 7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e
SHA512 d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

C:\Users\Admin\AppData\Local\Temp\E9CE.exe

MD5 c92201961c96b37acacd98170bdcb837
SHA1 5fcd8058d54a134a90998653ac2222f6aefee520
SHA256 cd541d789a0b045ddea37667c698bfb855e37e2db80abe6c7f33438541e6f1c0
SHA512 accb1126ad194bec28f7d915613d008136f36afa94affe9fa329795b01c5ad348272ecb1ae8582484cc8fc53e11e7aadfc723b22c4415278a47a384980d07c01

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\cookies.sqlite.id[21095B6C-3483].[[email protected]].8base

MD5 48adee496bba5732399ad77a4cc0fd69
SHA1 1b99c0451c508ce0da28b5d3d640bd979b23952a
SHA256 048c867f205a98f5fbe0f87b85f6787f3be47514d81980a7bf5b715ba2cc707f
SHA512 173cbff084d132dbb8172d5ad41364defb307317a751d1e9571c273728f78ff90a4b19089cead5a48780da39859d1a8b7129ae1d8019b08e49dbe496ada7adc2

C:\Users\Admin\AppData\Local\Temp\285E.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\285E.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be