Malware Analysis Report

2024-10-16 05:11

Sample ID 230918-cfkz3sgf65
Target 89fe28686a81b90bf1f46b6d46251ce4.bin
SHA256 691eaa4c48666b69ca180b9aae1a4035fefb29cef1f0a3cfbc91c020b0b09f40
Tags
ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

691eaa4c48666b69ca180b9aae1a4035fefb29cef1f0a3cfbc91c020b0b09f40

Threat Level: Known bad

The file 89fe28686a81b90bf1f46b6d46251ce4.bin was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan

AmmyyAdmin payload

Phobos

Ammyy Admin

SmokeLoader

Detect rhadamanthys stealer shellcode

Rhadamanthys

FlawedAmmyy RAT

Suspicious use of NtCreateUserProcessOtherParentProcess

Renames multiple (468) files with added filename extension

Deletes shadow copies

Renames multiple (312) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes backup catalog

Downloads MZ/PE file

Modifies Windows Firewall

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Drops startup file

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Accesses Microsoft Outlook profiles

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Checks processor information in registry

Modifies registry class

Interacts with shadow copies

outlook_win_path

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Modifies system certificate store

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-18 02:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-18 02:01

Reported

2023-09-18 02:03

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1676 created 3236 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (468) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\C493.tmp\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{FhL3P = "C:\\Users\\Admin\\AppData\\Local\\{FhL3P.exe" C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{FhL3P = "C:\\Users\\Admin\\AppData\\Local\\{FhL3P.exe" C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2890696111-2332180956-3312704074-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2890696111-2332180956-3312704074-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\C493.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\ui-strings.js.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\AFTRNOON.ELM C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-72_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupWideTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-150.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\w2k_lsa_auth.dll C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.schema.mfl C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RDCNotificationClient.appx.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\ui-strings.js.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\ui-strings.js.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\PointerIndicatorGeometryShader.cso C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder-default.svg.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_24.svg.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\mso.acl C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppUpdate.svg C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-lightunplated.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-32.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\prompts_en-GB_TTS.lua C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\RICEPAPR.ELM.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\ui-strings.js.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-time-l1-1-0.dll C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32_altform-lightunplated.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\VCRUNTIME140_APP.DLL C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Resource.psd1 C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\lo.pak C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\identity_helper.Sparse.Internal.msix.id[85CF9B55-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8344.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\C493.tmp\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 464 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 464 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 464 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 464 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 464 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 464 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 464 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 464 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1676 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 1676 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 1676 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 1676 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 2328 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 3868 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe
PID 4792 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Windows\system32\cmd.exe
PID 4792 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Windows\system32\cmd.exe
PID 4792 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Windows\system32\cmd.exe
PID 4792 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe C:\Windows\system32\cmd.exe
PID 2588 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe
PID 2588 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe
PID 2588 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe
PID 2588 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe
PID 2588 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe
PID 2588 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe
PID 1544 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1544 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3076 wrote to memory of 1136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3076 wrote to memory of 1136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4956 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 4956 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 4956 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 4956 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 4956 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 4956 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 3076 wrote to memory of 1868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3076 wrote to memory of 1868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1544 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1544 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1544 wrote to memory of 4980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1544 wrote to memory of 4980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1544 wrote to memory of 3304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1544 wrote to memory of 3304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1544 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1544 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3236 wrote to memory of 1500 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\8344.exe
PID 3236 wrote to memory of 1500 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\8344.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe

"C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe"

C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe

C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

"C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe"

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

"C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe"

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe

"C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe

C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe

C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe

"C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\8344.exe

C:\Users\Admin\AppData\Local\Temp\8344.exe

C:\Users\Admin\AppData\Local\Temp\85F5.exe

C:\Users\Admin\AppData\Local\Temp\85F5.exe

C:\Users\Admin\AppData\Local\Temp\8344.exe

C:\Users\Admin\AppData\Local\Temp\8344.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Local\Temp\85F5.exe

"C:\Users\Admin\AppData\Local\Temp\85F5.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\C493.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\C493.tmp\svchost.exe -debug

C:\Windows\SYSTEM32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\C493.tmp\aa_nts.dll",run

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
NL 141.98.6.38:39001 tcp
US 8.8.8.8:53 38.6.98.141.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
US 8.8.8.8:53 126.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 serverxlogs21.xyz udp
US 8.8.8.8:53 servxblog79.xyz udp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 mkstat227.xyz udp
US 8.8.8.8:53 232.127.45.5.in-addr.arpa udp
DE 45.155.173.227:80 mkstat227.xyz tcp
US 8.8.8.8:53 227.173.155.45.in-addr.arpa udp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 118.18.243.136.in-addr.arpa udp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 133.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp
EE 5.45.127.232:80 servxblog79.xyz tcp

Files

memory/464-0-0x0000000000890000-0x0000000000916000-memory.dmp

memory/464-1-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/464-2-0x0000000005840000-0x0000000005DE4000-memory.dmp

memory/464-3-0x0000000005330000-0x00000000053A8000-memory.dmp

memory/464-4-0x0000000005320000-0x0000000005330000-memory.dmp

memory/464-5-0x00000000054B0000-0x0000000005518000-memory.dmp

memory/464-6-0x0000000005530000-0x000000000557C000-memory.dmp

memory/1676-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1676-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1676-11-0x0000000000400000-0x0000000000473000-memory.dmp

memory/464-12-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/1676-13-0x0000000002EC0000-0x0000000002EC7000-memory.dmp

memory/1676-14-0x00000000030F0000-0x00000000034F0000-memory.dmp

memory/1676-15-0x00000000030F0000-0x00000000034F0000-memory.dmp

memory/1676-16-0x00000000030F0000-0x00000000034F0000-memory.dmp

memory/1676-17-0x00000000030F0000-0x00000000034F0000-memory.dmp

memory/1624-18-0x00000130E4560000-0x00000130E4563000-memory.dmp

memory/1676-19-0x0000000003E00000-0x0000000003E36000-memory.dmp

memory/1676-25-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1676-27-0x00000000030F0000-0x00000000034F0000-memory.dmp

memory/1676-26-0x0000000003E00000-0x0000000003E36000-memory.dmp

memory/1676-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1676-29-0x00000000030F0000-0x00000000034F0000-memory.dmp

memory/1624-30-0x00000130E4560000-0x00000130E4563000-memory.dmp

memory/1624-31-0x00000130E4800000-0x00000130E4807000-memory.dmp

memory/1624-33-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-32-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-35-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-34-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-36-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-38-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-40-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-41-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-42-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-43-0x00007FFCD8A10000-0x00007FFCD8C05000-memory.dmp

memory/1624-44-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-45-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-46-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-47-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

memory/1624-48-0x00007FF443940000-0x00007FF443A6F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/1624-52-0x00007FFCD8A10000-0x00007FFCD8C05000-memory.dmp

memory/2328-53-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/2328-54-0x0000000000C60000-0x0000000000CAC000-memory.dmp

memory/2328-55-0x0000000005540000-0x0000000005586000-memory.dmp

memory/2328-56-0x0000000005590000-0x00000000055C4000-memory.dmp

memory/2328-57-0x00000000054C0000-0x00000000054D0000-memory.dmp

memory/4792-58-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/2328-63-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4792-62-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-64-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\{FhL3P.exe.log

MD5 ff27e87d4bf1330435001e57e8244d60
SHA1 b22264ed3cd4d35f8236278edd2512c3b7ecb355
SHA256 7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e
SHA512 d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

memory/3868-67-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3868-68-0x0000000004E10000-0x0000000004E56000-memory.dmp

memory/3868-69-0x0000000004E50000-0x0000000004E60000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\{FhL3P.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/2020-75-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3868-74-0x0000000074F80000-0x0000000075730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe

MD5 edb0bd514f39df156ab362002be3ff90
SHA1 76b0fdba830567e6556c59a225767d2d8d90b64b
SHA256 1bcb8173519d2624b18401999e3fe7a22774067892c0f74d0c82f823b93afca2
SHA512 f3aeb9154275ec71d5bef818f67c631b5ae16986ecd55182c446f49f6512b83b26efac07a2617c633a81d5d008c82d4c3058fed434df7728e9b61bc5fd09bf7f

C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe

MD5 edb0bd514f39df156ab362002be3ff90
SHA1 76b0fdba830567e6556c59a225767d2d8d90b64b
SHA256 1bcb8173519d2624b18401999e3fe7a22774067892c0f74d0c82f823b93afca2
SHA512 f3aeb9154275ec71d5bef818f67c631b5ae16986ecd55182c446f49f6512b83b26efac07a2617c633a81d5d008c82d4c3058fed434df7728e9b61bc5fd09bf7f

memory/2588-79-0x00000000009B0000-0x00000000009FA000-memory.dmp

memory/2588-80-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/2588-81-0x00000000052D0000-0x0000000005314000-memory.dmp

memory/2588-82-0x0000000005550000-0x0000000005560000-memory.dmp

memory/2588-83-0x0000000002C80000-0x0000000002CB2000-memory.dmp

memory/1928-92-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Aw18]zp0.exe

MD5 edb0bd514f39df156ab362002be3ff90
SHA1 76b0fdba830567e6556c59a225767d2d8d90b64b
SHA256 1bcb8173519d2624b18401999e3fe7a22774067892c0f74d0c82f823b93afca2
SHA512 f3aeb9154275ec71d5bef818f67c631b5ae16986ecd55182c446f49f6512b83b26efac07a2617c633a81d5d008c82d4c3058fed434df7728e9b61bc5fd09bf7f

memory/1928-97-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4792-99-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-100-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-104-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

memory/2588-102-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4792-103-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-114-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-110-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-148-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4956-218-0x000002670BD60000-0x000002670BE46000-memory.dmp

memory/4792-149-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-122-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\W6qeg.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

memory/4792-219-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-257-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-310-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-309-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4792-256-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[85CF9B55-3483].[[email protected]].8base

MD5 3adf79f68f43dfa8afff4b980535adf5
SHA1 5ebefc0fc3cf8c4855f34ed19a33ed6fc2b06346
SHA256 0a8b60abe45024d2c8b47d5f90d7b7f365a59a93b016b00951dc2d7d17da1342
SHA512 947993f7952d102467484eadd0f05fecee45bba6b24c2b285faca7c1cc8b5db342249188601a04b894b9f275e5cfed2c9a37702ee67a20514ba95985cd9165e6

memory/4956-329-0x0000026726340000-0x0000026726422000-memory.dmp

memory/4956-255-0x00007FFCB99E0000-0x00007FFCBA4A1000-memory.dmp

memory/4956-350-0x000002670C290000-0x000002670C2A0000-memory.dmp

memory/4956-351-0x0000026726520000-0x00000267265F0000-memory.dmp

memory/2020-587-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4516-667-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/4516-735-0x00007FFCB99E0000-0x00007FFCBA4A1000-memory.dmp

memory/4516-751-0x0000027C31C20000-0x0000027C31C30000-memory.dmp

memory/4516-750-0x0000027C31B20000-0x0000027C31C22000-memory.dmp

memory/1928-792-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1624-918-0x00000130E4800000-0x00000130E4805000-memory.dmp

memory/4956-948-0x00007FFCB99E0000-0x00007FFCBA4A1000-memory.dmp

memory/1624-955-0x00007FFCD8A10000-0x00007FFCD8C05000-memory.dmp

memory/4516-1167-0x0000027C192D0000-0x0000027C192D8000-memory.dmp

memory/4516-1226-0x0000027C31DA0000-0x0000027C31DF6000-memory.dmp

memory/4516-1987-0x0000027C31C20000-0x0000027C31C30000-memory.dmp

memory/4516-2228-0x0000027C31C20000-0x0000027C31C30000-memory.dmp

memory/4516-2431-0x00007FFCB99E0000-0x00007FFCBA4A1000-memory.dmp

memory/4516-2958-0x0000027C31C20000-0x0000027C31C30000-memory.dmp

memory/4516-3993-0x0000027C31C20000-0x0000027C31C30000-memory.dmp

memory/4516-4453-0x0000027C31C20000-0x0000027C31C30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8344.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

C:\Users\Admin\AppData\Local\Temp\8344.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

C:\Users\Admin\AppData\Local\Temp\8344.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/1500-4685-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/1500-4751-0x0000000004E40000-0x0000000004E86000-memory.dmp

memory/1500-4762-0x0000000004E80000-0x0000000004E90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\85F5.exe

MD5 b1da22324541e3de280c13160289986a
SHA1 71786d8fa931c49e942bfe428aade8a15231852b
SHA256 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512 a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513

C:\Users\Admin\AppData\Local\Temp\85F5.exe

MD5 b1da22324541e3de280c13160289986a
SHA1 71786d8fa931c49e942bfe428aade8a15231852b
SHA256 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512 a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513

C:\Users\Admin\AppData\Local\Temp\8344.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cookies.sqlite.id[85CF9B55-3483].[[email protected]].8base

MD5 23f125bb76130dcbbc86601b31e6e61e
SHA1 af47ef638e70ea10bb2432aec7186e7094207d12
SHA256 c71f18330430341585092493377f6c14e2f98f10aeafb37c8245a26861924449
SHA512 00d5fcba959b67b7ad7be0857789de79d78e1e712d06f76a65d92013bade41228f68454b1e3dfced52843eeb13fad10905de8fbee9e0dd2a1120ae109e581126

C:\Users\Admin\AppData\Local\Temp\C493.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\C493.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\C493.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\C493.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\C493.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Aw18]zp0.exe.log

MD5 ff27e87d4bf1330435001e57e8244d60
SHA1 b22264ed3cd4d35f8236278edd2512c3b7ecb355
SHA256 7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e
SHA512 d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8344.exe.log

MD5 ff27e87d4bf1330435001e57e8244d60
SHA1 b22264ed3cd4d35f8236278edd2512c3b7ecb355
SHA256 7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e
SHA512 d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe.log

MD5 ff27e87d4bf1330435001e57e8244d60
SHA1 b22264ed3cd4d35f8236278edd2512c3b7ecb355
SHA256 7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e
SHA512 d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\W6qeg.exe.log

MD5 fd7d56e819012ae140f73eb5c2409e66
SHA1 109d8c07aef0c2bcd12722238a99bd2a2ac1289d
SHA256 8c8ef1a564cd0727c20b38defcf92921cc0cbfb804ea5bd470d474d448e0a569
SHA512 127a55daf176bf1834006b7ca8796f39a75a8d10f4de9562106ba3c8b4537edb37a243c8eb57e2ac53d77909fc0ee293484244da8805679e3a1f9e9109478443

C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

MD5 e33a54b4527295e71411f24583cafb51
SHA1 b0dec259cfe5ebb11bf9010ea9f786a51657c128
SHA256 2b31a5b46667cb90092232ca99c3f95139d16d4c6fd8003694043b7f24581b9a
SHA512 f24b3f616592af3fe9c4dac33094f8c732d827ce0ad4099e99dd7c6ccd47dcaeb887295a9401625e283e594b92c7f1ef224eb79cc6e3206e37b151561b423c73

C:\Users\Admin\AppData\Local\Temp\B05F\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml

MD5 94f90fcd2b8f7f1df69224f845d9e9b7
SHA1 a09e3072cc581cf89adaf1aa20aa89b3af7bf987
SHA256 a16113a66b1c36f919b5f7eaa3fb7aa8e0ba9e057823861aabea703cc06a04c0
SHA512 51f4ee06a8d8bf1121083bf4383433160f16c68d1fe4c44e5d0e0529910d27ba8446c7a4bef359b990574d1d61563da30139c6d09ad0ad1a5b5c7748b8da08f3

C:\Users\Admin\AppData\Local\Temp\C493.tmp\aa_nts.log

MD5 65d9b43b7430afa119faa85e1b9f681f
SHA1 93b76e2aba291de3404e2324df26c6b760744b6b
SHA256 4cf58f9c46df251715e8ed477f056c114718950e6e57bf34e1a1626076041877
SHA512 16fcd33dd6b70132def9f8503fc74772122497c572dd6f25c21e74866c181f2d02922874f5621686614fc81e6131358b4eec6596694fda641547e98f909af629

C:\Users\Admin\AppData\Local\Temp\C493.tmp\settings3.bin

MD5 e5410778fad16e3e6a837dcc1cb82e88
SHA1 f8d1e7df08af3546cc921ab45ef54064c0d174ae
SHA256 497e41d3268c4bc8bfee7b5b61565c58db79fbc703a3b9718ccbe05081832eb1
SHA512 5c10a142fbc3d3ac47d4d9287b2932ef55f04995b3d397df1205fce5c5ca2a5e5596c40a1f27708b785996bfc7647c0f8b11940552a7be10348492c8cb86ef7a

C:\Users\Admin\AppData\Local\Temp\C493.tmp\hr3

MD5 55fa47ef042a94c596a15112fb919dcd
SHA1 fab4b2abc164715524db8c3938c8a8ded5a440c1
SHA256 266641330ca3b1ecb2352fd0fb6eff5f78f7abb74f304ed111a90230d6de86de
SHA512 f21c997992efc992933234a214bd3adbbbcb50d25eb93949c636347ed1491d1634b850fcd63b8917df92d3422b71f489f91e68715f76445bd6eb4293268dd6da

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\SysWOW64\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\System32\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5037AC1E573F140500110A0B67548B5E

MD5 3ded6b04ef2e1535f18fa6c40fd2511d
SHA1 1ae3ad9acb4f7bda00b29becedd7d16c94ff7a4f
SHA256 2153af4aa1bbfd9fb8ac0f7f42a1275d138c89af1d7bb3cf2c69a01ccfdb2840
SHA512 844a2b73db84bd6800c123eb9e4507a4935a563771edb63d8f829793d8abe68c65d751a20d5c2853783e7c64559c438c4d96615a8163d83ba11fee63d6a6842d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 60fe01df86be2e5331b0cdbe86165686
SHA1 2a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512 ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5E

MD5 a4e3f1567b7b2686f1f407cd8513ba41
SHA1 96372b1e175367bc176d61507c6c4865744ea4b2
SHA256 84b0fe9a93f9244b235fe1cd1efd6a7f5ac6cb6552df1581905e2aaa1cc293ca
SHA512 72baaac9921b89096b966edeaab02af240029c76c017eb577dfaf41867fc2cc2bfceabaca3fa4823755154376247dac38ce1ece8f2ebae824fdeff4f54d41b5e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 79a4a895c3f01536ffd20875c6962a89
SHA1 458eb53f3b4e7b4b47814cd4a196a8b4aa42d306
SHA256 1f583faca984cbc7806cf34a2041e4dbfee82d09bc0ea34575c59ba57eec84ca
SHA512 b6c5672bc368c2939460d0464075050cb2517efb51ffa44598de6b26401fa9e7d71e107dc110e141f7be9fa65180dff73debfc3b4870fa2aca8c40f9775338fb

C:\Users\Admin\AppData\Local\Temp\B05F\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml

MD5 108f130067a9df1719c590316a5245f7
SHA1 79bb9a86e7a50c85214cd7e21719f0cb4155f58a
SHA256 c91debd34057ca5c280ca15ac542733930e1c94c7d887448eac6e3385b5a0874
SHA512 d43b3861d5153c7ca54edd078c900d31599fc9f04d6883a449d62c7e86a105a3c5dfb2d232255c41505b210b063caf6325921dc074fcdf93407c9e2c985a5301

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\System32\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\System32\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\B05F\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml

MD5 108f130067a9df1719c590316a5245f7
SHA1 79bb9a86e7a50c85214cd7e21719f0cb4155f58a
SHA256 c91debd34057ca5c280ca15ac542733930e1c94c7d887448eac6e3385b5a0874
SHA512 d43b3861d5153c7ca54edd078c900d31599fc9f04d6883a449d62c7e86a105a3c5dfb2d232255c41505b210b063caf6325921dc074fcdf93407c9e2c985a5301

C:\Users\Admin\AppData\Local\Temp\B05F\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml

MD5 94f90fcd2b8f7f1df69224f845d9e9b7
SHA1 a09e3072cc581cf89adaf1aa20aa89b3af7bf987
SHA256 a16113a66b1c36f919b5f7eaa3fb7aa8e0ba9e057823861aabea703cc06a04c0
SHA512 51f4ee06a8d8bf1121083bf4383433160f16c68d1fe4c44e5d0e0529910d27ba8446c7a4bef359b990574d1d61563da30139c6d09ad0ad1a5b5c7748b8da08f3

C:\Users\Admin\AppData\Local\Temp\B05F\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe

MD5 cfe72ed40a076ae4f4157940ce0c5d44
SHA1 8010f7c746a7ba4864785f798f46ec05caae7ece
SHA256 6868894ab04d08956388a94a81016f03d5b7a7b1646c8a6235057a7e1e45de32
SHA512 f002afa2131d250dd6148d8372ce45f84283b8e1209e91720cee7aff497503d0e566bae3a83cd326701458230ae5c0e200eec617889393dd46ac00ff357ff1b0

C:\Users\Admin\AppData\Local\Temp\B05F\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll

MD5 a71c7262b0c960555b9f9c8b8c00b435
SHA1 0ae6a658909059dbbb5316a45bdd41bcde06d272
SHA256 768935f1da43b1c28a51ce2fb79423e6705ee2deb899b349f01a7735368ce873
SHA512 54c934263ed268ef2b40dc367fd89d557d0024e702bb672bd51add5b9e294b96795558b287315dda23b5adf9bc478bc8bf2ea0c3c72664ec62b9e0f4ad185218

C:\Users\Admin\AppData\Roaming\cfiftwj

MD5 edb0bd514f39df156ab362002be3ff90
SHA1 76b0fdba830567e6556c59a225767d2d8d90b64b
SHA256 1bcb8173519d2624b18401999e3fe7a22774067892c0f74d0c82f823b93afca2
SHA512 f3aeb9154275ec71d5bef818f67c631b5ae16986ecd55182c446f49f6512b83b26efac07a2617c633a81d5d008c82d4c3058fed434df7728e9b61bc5fd09bf7f

C:\Users\Admin\AppData\Roaming\wibrfbu

MD5 64a3aadcea117c1613b6bd88344c93fb
SHA1 dbb10e92c512b2da33b07645e3cbcf70c94cdd54
SHA256 40d91743117814d2df0e7e156e0e27f95a2a1b056a7decf4a5f10e6c17afc976
SHA512 c3f5c6ca42f544bf1cf303e797a3085a70e234db10ec1b2377e6c03d57bf539398549b3ee399ddd08f54174a0e9b879404a70174ab9836a9d80f5fd13506ef6a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000028.db.id[85CF9B55-3483].[[email protected]].8base

MD5 8bb6aa7274f186725167ecb452a3ab64
SHA1 b72848a428782491529871027ec51ec630c7e2f1
SHA256 6a21ba29a38dec3eb1e1f5ea44cd387ec1542763a5bc796c36ccf2ba1af63d19
SHA512 ac47dddf58512442bb477398d5186225a78192d2e871a0e9d072d3a8225ae27afb4a6771deeaeeb7621f2c3e09978e6640965b8160aaedd687f9fa4bd343c4d9

C:\info.hta

MD5 f823e31d7724ea3954790f4517cdc747
SHA1 06a7bc5d606d17380811d260f8e4fa7938d4d66e
SHA256 7dbbd66896d78d6ad13b5540a522c9c448433b40e268f61884779a14863a7c5b
SHA512 2c9c48ca947f485270444c5d0f9ac572744dfae6116eb044612b805dd0ddd0c19959c17a41e30ce255d6e2e0985e489f44cde14d968b5f77c58de9f577ab30dd

C:\users\public\desktop\info.hta

MD5 f823e31d7724ea3954790f4517cdc747
SHA1 06a7bc5d606d17380811d260f8e4fa7938d4d66e
SHA256 7dbbd66896d78d6ad13b5540a522c9c448433b40e268f61884779a14863a7c5b
SHA512 2c9c48ca947f485270444c5d0f9ac572744dfae6116eb044612b805dd0ddd0c19959c17a41e30ce255d6e2e0985e489f44cde14d968b5f77c58de9f577ab30dd

C:\Users\Admin\Desktop\info.hta

MD5 f823e31d7724ea3954790f4517cdc747
SHA1 06a7bc5d606d17380811d260f8e4fa7938d4d66e
SHA256 7dbbd66896d78d6ad13b5540a522c9c448433b40e268f61884779a14863a7c5b
SHA512 2c9c48ca947f485270444c5d0f9ac572744dfae6116eb044612b805dd0ddd0c19959c17a41e30ce255d6e2e0985e489f44cde14d968b5f77c58de9f577ab30dd

C:\info.hta

MD5 f823e31d7724ea3954790f4517cdc747
SHA1 06a7bc5d606d17380811d260f8e4fa7938d4d66e
SHA256 7dbbd66896d78d6ad13b5540a522c9c448433b40e268f61884779a14863a7c5b
SHA512 2c9c48ca947f485270444c5d0f9ac572744dfae6116eb044612b805dd0ddd0c19959c17a41e30ce255d6e2e0985e489f44cde14d968b5f77c58de9f577ab30dd

F:\info.hta

MD5 f823e31d7724ea3954790f4517cdc747
SHA1 06a7bc5d606d17380811d260f8e4fa7938d4d66e
SHA256 7dbbd66896d78d6ad13b5540a522c9c448433b40e268f61884779a14863a7c5b
SHA512 2c9c48ca947f485270444c5d0f9ac572744dfae6116eb044612b805dd0ddd0c19959c17a41e30ce255d6e2e0985e489f44cde14d968b5f77c58de9f577ab30dd

C:\Users\Admin\AppData\Local\Temp\85F5.exe

MD5 b1da22324541e3de280c13160289986a
SHA1 71786d8fa931c49e942bfe428aade8a15231852b
SHA256 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512 a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.id[85CF9B55-3483].[[email protected]].8base

MD5 cd7d5dfc7bd0c92e0ba5df52c43eb63b
SHA1 1d8213504b21801ca8994eb1826dfc65447333f6
SHA256 9bf67075b57a27e7cff7764ab55e6526a10b6abfc2c09bb8564403b1c1b52e3a
SHA512 8d8fe3f71eb363d1e432587c712738708adb2a418e27eea14e7c70fa920ce850f50df67a37121d5d6a5de3e5c85a4ee1f01a98589282f1b96b4db18ba3ee1507

C:\Users\Admin\AppData\Local\Temp\B05F\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll.id[85CF9B55-3483].[[email protected]].8base

MD5 a71c7262b0c960555b9f9c8b8c00b435
SHA1 0ae6a658909059dbbb5316a45bdd41bcde06d272
SHA256 768935f1da43b1c28a51ce2fb79423e6705ee2deb899b349f01a7735368ce873
SHA512 54c934263ed268ef2b40dc367fd89d557d0024e702bb672bd51add5b9e294b96795558b287315dda23b5adf9bc478bc8bf2ea0c3c72664ec62b9e0f4ad185218

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\System32\Windows.ApplicationModel.Wallet.dll.id[85CF9B55-3483].[[email protected]].8base

MD5 05219a70bf6158918dd7de788fcb8186
SHA1 1619b8c4c75d2aeefbd8f15ee8dca595286355ba
SHA256 dd457461d2bf4acdbc58ea5fb3369d645f483be8cffc4f673239d2c89ad11bef
SHA512 7a0888865a2e638d6e6fe99fec7ded2821a98dcaa040e95ba874a547138c00b7cfa2ddba4fc48220b23de28e94628c84b7e25566873e3d3aaea33020ae9a24f0

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\System32\WalletProxy.dll.id[85CF9B55-3483].[[email protected]].8base

MD5 601b6b4236d4d21dd8b28b87f97d0793
SHA1 f44adedcdc79a93a21d1b23b7e7a2f2964a1bf95
SHA256 c9fb9ee0b1a86009e1341cf13b654ff82f1f4296202707bc8017440a859ea200
SHA512 646aeaa57eaa9be913762a6b2a9449da7e4280ce0f1b2a726270fda6d9cf6dad871bb8682b93927d083030c623e5279fbda8610c750f091a6d0a882eadf7d93a

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\System32\WalletBackgroundServiceProxy.dll.id[85CF9B55-3483].[[email protected]].8base

MD5 081b9c74f0e8bdfc7e5dabcf445558cf
SHA1 c7f09c2f3fa96fcc16da6969643ad2cdb4dd9d49
SHA256 96d901bfd02850ed070e561c18d3761c9e6f63b1ce006fba1b6eca9e077652a7
SHA512 634dda47b68dadf9ac999d09dd4bbe00b2e2b79699546afe69c432195596d1c3e85ac8e8dafb2eb4e0a28c6b182bca28db2726eca02acbb9d8e6fc2e462bcb0d

C:\Users\Admin\AppData\Local\Temp\B05F\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml.id[85CF9B55-3483].[[email protected]].8base

MD5 11ebb6a5cc44fe22754d686f018259eb
SHA1 8d9c9f9690bc723b8d2dec7142b6f58e9d5dbcae
SHA256 4198f5ccf2fcf8c4f270eba9a5fef63a4a52b0d05befc2dd393e5db51127a9aa
SHA512 acc45d9bad5b378756f9c53c5f7841a6800f0520c261c26b758da6c52c15770d00f3fd1a10ee953060c2ab0b58d0505d167a1d4b9a9c8877853777616ce2e09b

C:\Users\Admin\AppData\Local\Temp\B05F\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml.id[85CF9B55-3483].[[email protected]].8base

MD5 1b42b19a35f4d9b5fa42010c260bc86f
SHA1 bb015a0f1b8e9125ecb7ee3a2ad5e2880b8b8643
SHA256 63160c8967791122d5b0a812538a16081df303a5553f275fc56460a9c3fea1e3
SHA512 cbefdc1b8c75dabb08160321f5dfb9069396061f3fa4b31bb8dd60ddebd278877b7a56853755daaa8b726e0b883d076ee9ece930197d7fcd13083942e74fed98

C:\Users\Admin\AppData\Local\Temp\B05F\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml.id[85CF9B55-3483].[[email protected]].8base

MD5 ea6081cabff114fe359be30590998197
SHA1 eb8fb936bed1ef2d0d5e82b9ba82a2c828b53be1
SHA256 f5de1e026d07fc60844742b05f4a248d2345ca2d0ebadae8393afae63f883329
SHA512 722381e533de964c47bf655fd1b75519770681bdb5c8dd4aec50bcaac52c8f5ad3276d28c0da232ed1bf5a91a52b87385d9592d25cc60146fb9083569f3d8acf

C:\Users\Admin\AppData\Local\Temp\B05F\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml.id[85CF9B55-3483].[[email protected]].8base

MD5 6589b7d9783850ef8644601468a1d4b1
SHA1 49b40a40f8e05ee83b3394c4458f4f66f86890b3
SHA256 c0d6587d2bada028018251d916da6fa9993fe654abffc8f350bcc34356608e58
SHA512 fb069e48dff96071e2a1b754dbe8b89b5d816f30d45551c2dc3ecfe317192c93f709e4a0f3b5e95e94b59d0bb9a8a812c46f06ef045e4d122f221f7e8fa80dae

C:\Users\Admin\AppData\Local\Temp\B05F\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe.id[85CF9B55-3483].[[email protected]].8base

MD5 69d7efc3c2af0f5ec75d6a6771171f7f
SHA1 954336be2b98921f3c5a50e0ec4cbcbfb7fd156a
SHA256 c9c2672c43c92991c59743f0eac9f634a6fa746efb5043d25ef0fc637d442d97
SHA512 974f5c29b1751949685fc72f816e23d4d307cf236684b23b59d72124acc880b92fa556f392959876e201b0beaf08b3dd56450355013ec06b1aa5280493d5d3cb

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\B05F\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-18 02:01

Reported

2023-09-18 02:03

Platform

win7-20230831-en

Max time kernel

142s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2360 created 1208 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (312) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1880.exe C:\Users\Admin\AppData\Local\Temp\1880.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1880 = "C:\\Users\\Admin\\AppData\\Local\\1880.exe" C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\1880 = "C:\\Users\\Admin\\AppData\\Local\\1880.exe" C:\Users\Admin\AppData\Local\Temp\1880.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YK5VI4QL\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDLDGKZQ\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RIT0VQ4M\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3750544865-3773649541-1858556521-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WYZEMTEU\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z0TR3CUC\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JQALZ7NY\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3750544865-3773649541-1858556521-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\1880.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0214934.WMF.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\RPLBRF35.CHM.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217872.WMF C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Samara.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado28.tlb C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSRuntimeUI.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL.IDX_DLL C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178639.JPG C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OIS_COL.HXT C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BREEZE.WAV.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\drag.png C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\instrument.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285698.WMF.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Custom.propdesc C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImagesMask.bmp C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\DEEPBLUE.INF C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\mozwer.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.INF.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01368_.WMF C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZFORM.XML.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSWDS_EN.LEX.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00578_.WMF.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZDAT12.ACCDU.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN107.XML.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\WMPMediaSharing.dll.mui C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32r.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\QP.XML.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233312.WMF C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SPRNG_01.MID.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.id[EC892D17-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml C:\Users\Admin\AppData\Local\Temp\1880.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1DED.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1880.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 1116 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
PID 2360 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 2360 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 2360 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 2360 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 2360 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 2360 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe C:\Windows\system32\certreq.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 2856 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe
PID 1872 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Users\Admin\AppData\Local\Microsoft\[email protected]
PID 1872 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Users\Admin\AppData\Local\Microsoft\[email protected]
PID 1872 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Users\Admin\AppData\Local\Microsoft\[email protected]
PID 1872 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Users\Admin\AppData\Local\Microsoft\[email protected]
PID 1872 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Users\Admin\AppData\Local\Microsoft\[email protected]
PID 1872 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Users\Admin\AppData\Local\Microsoft\[email protected]
PID 1872 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Users\Admin\AppData\Local\Microsoft\[email protected]
PID 2828 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 2828 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 1208 wrote to memory of 2120 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\1880.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe

"C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe"

C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe

C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe

"C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe"

C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe

C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

"C:\Users\Admin\AppData\Local\Microsoft\[email protected]"

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe

"C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\1880.exe

C:\Users\Admin\AppData\Local\Temp\1880.exe

C:\Users\Admin\AppData\Local\Temp\1880.exe

C:\Users\Admin\AppData\Local\Temp\1880.exe

C:\Users\Admin\AppData\Local\Temp\1880.exe

"C:\Users\Admin\AppData\Local\Temp\1880.exe"

C:\Users\Admin\AppData\Local\Temp\1880.exe

C:\Users\Admin\AppData\Local\Temp\1880.exe

C:\Users\Admin\AppData\Local\Temp\1DED.exe

C:\Users\Admin\AppData\Local\Temp\1DED.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\1DED.exe

"C:\Users\Admin\AppData\Local\Temp\1DED.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe -debug

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\650A.tmp\aa_nts.dll",run

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 serverxlogs21.xyz udp
US 8.8.8.8:53 servxblog79.xyz udp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 mkstat227.xyz udp
DE 45.155.173.227:80 mkstat227.xyz tcp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
EE 5.45.127.232:80 servxblog79.xyz tcp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.121.132:80 apps.identrust.com tcp
DE 85.10.193.215:80 tcp

Files

memory/1116-0-0x0000000000950000-0x00000000009D6000-memory.dmp

memory/1116-1-0x0000000074720000-0x0000000074E0E000-memory.dmp

memory/1116-2-0x0000000000690000-0x0000000000708000-memory.dmp

memory/1116-3-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

memory/1116-4-0x0000000002100000-0x0000000002168000-memory.dmp

memory/1116-5-0x0000000000420000-0x000000000046C000-memory.dmp

memory/2360-6-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2360-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2360-8-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2360-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2360-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2360-14-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2360-16-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1116-17-0x0000000074720000-0x0000000074E0E000-memory.dmp

memory/2360-18-0x00000000001A0000-0x00000000001A7000-memory.dmp

memory/2360-19-0x0000000001DE0000-0x00000000021E0000-memory.dmp

memory/2360-20-0x0000000001DE0000-0x00000000021E0000-memory.dmp

memory/2360-21-0x0000000001DE0000-0x00000000021E0000-memory.dmp

memory/2360-22-0x0000000001DE0000-0x00000000021E0000-memory.dmp

memory/2880-23-0x00000000000E0000-0x00000000000E3000-memory.dmp

memory/2360-24-0x00000000003C0000-0x00000000003F6000-memory.dmp

memory/2360-30-0x00000000003C0000-0x00000000003F6000-memory.dmp

memory/2360-31-0x0000000001DE0000-0x00000000021E0000-memory.dmp

memory/2360-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2880-33-0x00000000000E0000-0x00000000000E3000-memory.dmp

memory/2880-34-0x00000000002B0000-0x00000000002B7000-memory.dmp

memory/2880-35-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-36-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-37-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-38-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-39-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-41-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-43-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-45-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-44-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-46-0x0000000077520000-0x00000000776C9000-memory.dmp

memory/2880-47-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-48-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-49-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2880-50-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/2880-54-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2856-55-0x0000000000D30000-0x0000000000D7C000-memory.dmp

memory/2856-58-0x0000000000330000-0x0000000000376000-memory.dmp

memory/2880-60-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2856-59-0x0000000000470000-0x00000000004A4000-memory.dmp

memory/2856-57-0x00000000745A0000-0x0000000074C8E000-memory.dmp

memory/2856-61-0x0000000004AC0000-0x0000000004B00000-memory.dmp

memory/2288-62-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2288-64-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2288-66-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2288-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2288-67-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2856-73-0x00000000745A0000-0x0000000074C8E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

MD5 edb0bd514f39df156ab362002be3ff90
SHA1 76b0fdba830567e6556c59a225767d2d8d90b64b
SHA256 1bcb8173519d2624b18401999e3fe7a22774067892c0f74d0c82f823b93afca2
SHA512 f3aeb9154275ec71d5bef818f67c631b5ae16986ecd55182c446f49f6512b83b26efac07a2617c633a81d5d008c82d4c3058fed434df7728e9b61bc5fd09bf7f

memory/2880-77-0x0000000077520000-0x00000000776C9000-memory.dmp

memory/1872-79-0x00000000005A0000-0x00000000005E4000-memory.dmp

memory/1872-81-0x0000000000560000-0x00000000005A0000-memory.dmp

memory/1872-80-0x0000000000A80000-0x0000000000AB2000-memory.dmp

memory/1872-78-0x00000000745A0000-0x0000000074C8E000-memory.dmp

memory/1624-82-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1872-76-0x0000000000C50000-0x0000000000C9A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

MD5 edb0bd514f39df156ab362002be3ff90
SHA1 76b0fdba830567e6556c59a225767d2d8d90b64b
SHA256 1bcb8173519d2624b18401999e3fe7a22774067892c0f74d0c82f823b93afca2
SHA512 f3aeb9154275ec71d5bef818f67c631b5ae16986ecd55182c446f49f6512b83b26efac07a2617c633a81d5d008c82d4c3058fed434df7728e9b61bc5fd09bf7f

C:\Users\Admin\AppData\Local\Microsoft\6oPX.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/2288-70-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2288-65-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2288-63-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1624-85-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1624-87-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1624-89-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

MD5 edb0bd514f39df156ab362002be3ff90
SHA1 76b0fdba830567e6556c59a225767d2d8d90b64b
SHA256 1bcb8173519d2624b18401999e3fe7a22774067892c0f74d0c82f823b93afca2
SHA512 f3aeb9154275ec71d5bef818f67c631b5ae16986ecd55182c446f49f6512b83b26efac07a2617c633a81d5d008c82d4c3058fed434df7728e9b61bc5fd09bf7f

memory/1624-91-0x0000000000400000-0x0000000000409000-memory.dmp

\Users\Admin\AppData\Local\Microsoft\396RUE.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

C:\Users\Admin\AppData\Local\Microsoft\396RUE.exe

MD5 7b4f90ff07d0fa2e763fd680b1e963c9
SHA1 47f1d9453dd31b2467f3f11580fba975ed69246d
SHA256 5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0
SHA512 5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

memory/1872-95-0x00000000745A0000-0x0000000074C8E000-memory.dmp

memory/2828-96-0x0000000000920000-0x0000000000A06000-memory.dmp

memory/2828-97-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

memory/2828-98-0x000000001BB10000-0x000000001BBF2000-memory.dmp

memory/2828-99-0x000000001BCF0000-0x000000001BD70000-memory.dmp

memory/2828-100-0x000000001BBF0000-0x000000001BCC0000-memory.dmp

memory/2828-101-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

memory/1208-102-0x0000000002C40000-0x0000000002C56000-memory.dmp

memory/1624-103-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2880-107-0x0000000077520000-0x00000000776C9000-memory.dmp

memory/2880-106-0x00000000002B0000-0x00000000002B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1880.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/2120-119-0x0000000000020000-0x000000000006C000-memory.dmp

memory/2120-120-0x0000000073EB0000-0x000000007459E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1880.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/2120-121-0x0000000004B80000-0x0000000004BC0000-memory.dmp

\Users\Admin\AppData\Local\Temp\1880.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

C:\Users\Admin\AppData\Local\Temp\1880.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/1360-141-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1880.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/2324-146-0x0000000073EB0000-0x000000007459E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1DED.exe

MD5 b1da22324541e3de280c13160289986a
SHA1 71786d8fa931c49e942bfe428aade8a15231852b
SHA256 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512 a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513

memory/1560-151-0x0000000001290000-0x0000000001306000-memory.dmp

memory/1560-152-0x0000000073EB0000-0x000000007459E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1DED.exe

MD5 b1da22324541e3de280c13160289986a
SHA1 71786d8fa931c49e942bfe428aade8a15231852b
SHA256 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512 a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513

memory/2288-154-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2324-153-0x0000000000230000-0x0000000000276000-memory.dmp

memory/2324-155-0x0000000000670000-0x00000000006B0000-memory.dmp

memory/2120-143-0x0000000073EB0000-0x000000007459E000-memory.dmp

\Users\Admin\AppData\Local\Temp\1880.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

C:\Users\Admin\AppData\Local\Temp\1880.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/2324-168-0x0000000073EB0000-0x000000007459E000-memory.dmp

memory/948-171-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1560-172-0x0000000004830000-0x0000000004870000-memory.dmp

memory/2492-186-0x0000000000080000-0x00000000000EB000-memory.dmp

memory/1716-188-0x0000000000060000-0x000000000006C000-memory.dmp

memory/1560-189-0x0000000004780000-0x00000000047C2000-memory.dmp

memory/1560-194-0x0000000004830000-0x0000000004870000-memory.dmp

memory/1508-193-0x00000000000C0000-0x00000000000CB000-memory.dmp

memory/2312-192-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2312-195-0x0000000004830000-0x0000000004870000-memory.dmp

C:\Users\Admin\AppData\Local\1880.exe

MD5 5dfa266ba1b2d2a79e33da57c251a247
SHA1 0da6e8d74f0bbec9e947dac86786489c56bd8191
SHA256 e3f1e4967051b024524bbb675cdff946ad2b162c88cc04685adc5b937c55c1a9
SHA512 0684d1ef15ddf71671e5bdc10f7c52927877bd6e04ace8308cae433b539bc383bc1115ff7e82713cbcab8bf3a57784b43ed671ce8697a301b18d689c533416a8

memory/1560-213-0x00000000007A0000-0x00000000007BA000-memory.dmp

memory/1560-215-0x0000000000C20000-0x0000000000C26000-memory.dmp

memory/1268-217-0x0000000000090000-0x0000000000097000-memory.dmp

memory/1268-218-0x0000000000080000-0x000000000008B000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[EC892D17-3483].[[email protected]].8base

MD5 0e361a17489fce81f54edf105ed689a5
SHA1 05a9e9b627110e261a3b1ca44ad575f6fb49b507
SHA256 354df14fde8eb9a5df8ccd23fa46cd01d96860a78569dc90c96da721eee2b44b
SHA512 319e9d3da67773c11ac2116a40ab018dbf64eaaa464a04b8cbf7ae94dc5c052630498b896723ec82c7bfdffb7513788bf5211d1b65d78af1eb3cc93a068aa8a3

\Users\Admin\AppData\Local\Temp\1DED.exe

MD5 b1da22324541e3de280c13160289986a
SHA1 71786d8fa931c49e942bfe428aade8a15231852b
SHA256 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512 a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513

memory/1360-326-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\650A.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\Cab7CDF.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar7E68.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8bd43d4e9434bee60acb77ae7a739751
SHA1 b5cad28400542abb80ce15273d10e5951e81167d
SHA256 fbaf10308dfead95bf1d50bda6cb0306a9a63b25e58fd69270ea83dec728f44b
SHA512 95ba2e6cf9430257f1c0ee9514d5c4a1f1248cddddf9e1fe6c3c614a46a21afceb60a3826bcc7dd0657f46d429c38c7fcec5797f2b65e7b44215949328f9ee1e

C:\Users\Admin\AppData\Local\Temp\650A.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

\Users\Admin\AppData\Local\Temp\650A.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\650A.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\650A.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\650A.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\650A.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\1DED.exe

MD5 b1da22324541e3de280c13160289986a
SHA1 71786d8fa931c49e942bfe428aade8a15231852b
SHA256 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512 a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513

C:\Users\Admin\AppData\Local\Temp\650A.tmp\hr3

MD5 8122a75c0693a0bded9603c7fdada20a
SHA1 042d120c92d937bec5791e4f13ffb151fc3d9c96
SHA256 fea0ce879236332ca80f6d8ab55d41b1f6fce903a3901c17d4438c4bd64b1b64
SHA512 8430815ad95dc53117e0cff49130fd162b1c13e975fc0a4fe470428923111f6a23e62c3154a5f1a16e90d90a1c8f4b19f9540f1eb2b19fbd8c7e5fa4e9126016

C:\Users\Admin\AppData\Local\Temp\650A.tmp\settings3.bin

MD5 9cf7dbafc73193c3813920793b9ad924
SHA1 6f5b6f291eecac2c66a8635f0074a879b71d54f6
SHA256 a08d9c83e04425e1246dfbf0d5f94b8061ee1963e4ddb2dcd3166de2981e602d
SHA512 04a874a6ac352e6ea79142f3be28af1f9434788b7955749414d4a5119721e798215af196b2b2b084b84f99999725d9e3391a9873ed3982be54b3af6fe360a5ef

C:\Users\Admin\AppData\Local\Temp\650A.tmp\aa_nts.log

MD5 b8e02d09dd91ab3535e9f1bd4a2f99d9
SHA1 737fd80caf893869eb7055df8563e1f3ac615143
SHA256 eea8e6ef951da566e4d95c08d3731359ad2ab189743d1fa4991c18611ebe1a2e
SHA512 fe245344a94ed14e7c8105135aaeae9dab629e47e3fb7530197f4c5a67d768bb4d32cddae50fe4b0ea2fec7f85503df46cbf06f0737798e832a627eeece57ff0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 60fe01df86be2e5331b0cdbe86165686
SHA1 2a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512 ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5037AC1E573F140500110A0B67548B5E

MD5 3ded6b04ef2e1535f18fa6c40fd2511d
SHA1 1ae3ad9acb4f7bda00b29becedd7d16c94ff7a4f
SHA256 2153af4aa1bbfd9fb8ac0f7f42a1275d138c89af1d7bb3cf2c69a01ccfdb2840
SHA512 844a2b73db84bd6800c123eb9e4507a4935a563771edb63d8f829793d8abe68c65d751a20d5c2853783e7c64559c438c4d96615a8163d83ba11fee63d6a6842d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA512 1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 4af8d4def9048c5da18031508add1dd3
SHA1 761f4d4e05bd9331decc5a0ab1e43c0cb6043a28
SHA256 88fbd0a7800441f15b6e2c0a8850f6599eca6a401d5a9c0c8ff5f16a9d9aa421
SHA512 90259652797c3f92b8e9496f6f6e013f40bfc20de8e1d4139476301a50c7517df1897f88d4232c14d72a594d7a3038ec1ddf5713f1cd55d44805b3de6a4a1b7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5E

MD5 03be5fb78878800c4002ac37a24b7a8a
SHA1 7f1355b62e291365ddd24a93431c36f07bef677e
SHA256 948ca9cefde364d640a95f89b16f8e7bbfc5b1c63242889fb78b1c86a63a4b37
SHA512 3ad99b0eac81d55efa0fd9e8ea6a9bfeb72453311bf43e934fc19a4b33f4299c027570d4b9c29df8aa8b4869c1a3e19411ae22f092444c3c208e3ddda136e0e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d9416bac97c61ab2467412601e30dcca
SHA1 9838f58a0c05be20becb007777c7ee3d324298e1
SHA256 485908ac4faaa6381f6d78cbe1215282b4836f6ee03be3a57276f3d922be96a6
SHA512 6735d88ff0d0700ef74237a6e1d5f63d210d86cf093381900ae5d39c7edee2dd2bc4174dfe185d5177c6e86b6e37ef3efb453830eaf8c6cd280467bd118d6b21

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 5cc76d5304b8a677721b21b0f5c8a4ea
SHA1 f02fb50a35ffffd31e97d238cc3e78520f8a0015
SHA256 db71966eac32a98bb70291b62a5642c95f186ee1f33a3a9fdc7b1fb2933c8d7c
SHA512 f4c7726f4c61576bedaec589e64666850b142a34fd4712753ffd09e87f2339af64fab703bfe62eb2e505e1e7236a6fb00e9fd8c5d9c9ec91dfc70b7264ec4813

C:\Users\Admin\AppData\Roaming\bvwcjrc

MD5 cd040505beda71b3e96e8d580319463b
SHA1 dc9ff1a904a7c5f0d0a3f562d184ddfdd0b6652d
SHA256 092f0bff26debc9558efe3e6723cc93e03c342e7efc2b36157f829ef684ddf19
SHA512 6232eee62b45e6c57c279daf099cc0220cbab1daa717f7dc6cc916b6baf5140c1093be2aced010bbebc81b2ee79f9f54a08e37d8fb22a3de142482923cbd7be3

C:\Users\Admin\AppData\Roaming\ccvtijc

MD5 edb0bd514f39df156ab362002be3ff90
SHA1 76b0fdba830567e6556c59a225767d2d8d90b64b
SHA256 1bcb8173519d2624b18401999e3fe7a22774067892c0f74d0c82f823b93afca2
SHA512 f3aeb9154275ec71d5bef818f67c631b5ae16986ecd55182c446f49f6512b83b26efac07a2617c633a81d5d008c82d4c3058fed434df7728e9b61bc5fd09bf7f

C:\Users\Admin\Desktop\RegisterUse.ico.id[EC892D17-3483].[[email protected]].8base

MD5 52c36e1b504ed2ebe24305979dea8bd7
SHA1 702ec31f215945bd4595b1286755d24718c61993
SHA256 a23914c39c0eb487a27fdbb21872e32d9896946b81ab24e91485efd6ee3413e3
SHA512 ab2399a35318c62d4529cbb1ea922e962fa7f19f89437d3d870c92848575bcbc7e97c62169ffab38465a33d24973d18ed8564b08d7ce9139af4768a6de73a038

C:\Users\Admin\Desktop\RequestPush.cab.id[EC892D17-3483].[[email protected]].8base

MD5 6bafe705c80afd5be52b38f1a85f2d45
SHA1 968c6e75ca58c6f0e5b06836a8fe1c45a933775a
SHA256 86b30e88daba1b8e076d62ad3f8050d3be734a062e3a045f7dd1282bf1c34a8e
SHA512 c83816f2ee6281717c7036bbb29f1a223c7086c4aa3c1a2fa508af6c3f777bd37e22c0247d9da83dda3eaad0da5aba74687fa33e2c0878827ba96217cccb8e97

C:\Users\Admin\Desktop\SendImport.jpg.id[EC892D17-3483].[[email protected]].8base

MD5 024279e9eea8faae1301b860d29338b3
SHA1 da83d86bb8c28b970636880b104e0934813e2855
SHA256 0c875c6d69f26f565b05fa929f4b3f28ae6fea6c8843290c876e6f3bd694502a
SHA512 4921ad3f2647e62bf92fbdb0cc78f1e212039ff2affe231fe101ed7b2f7802081ae985607c65991e286382d82224094be9ffa0998c0374be5f7c998e39bcf68f

C:\Users\Admin\Desktop\CheckpointConfirm.ps1.id[EC892D17-3483].[[email protected]].8base

MD5 bb6547a1258fa7fcdec4049fcad8abb7
SHA1 efc59e3c7f02b5868b6676f1640e95b0e4bb5fe7
SHA256 2fe96774d4b1ec0474ecd86c3754e68d587d908552a0a0d6d9d016c35bedc962
SHA512 3e1037c42569f21ab17b932e4a549732f0ba6a0672487afdb839faa4d1b426b72dbcff5af1a3ea3edb949f6c5f724ad00c89a69bd806f959ed5f7ff931c4e27b

C:\Users\Admin\Desktop\AddConvertTo.mpe.id[EC892D17-3483].[[email protected]].8base

MD5 6e6207aad7d15f8264183a4fd0cdbb83
SHA1 391b3665a904a135c63f9b519f1bbd0cd19accf4
SHA256 559fb7ac6b79a2d1c4ea343a6659f4ed35779fddb9b33b8062c302a3851d1120
SHA512 322c4d13bcb1a5e6d9abb74821d98d61040e19f84cf4b156807af6e4566eee8ba632a93eb2c518cbeb72947cf5702ca362b82e6efe16d306def266500e615303

C:\Users\Admin\Desktop\BackupResolve.3gpp.id[EC892D17-3483].[[email protected]].8base

MD5 fa71759a9fd2bdcd3857400f8c915529
SHA1 5b325ad0cab6393fe3e25dc54aef471240e2eb60
SHA256 cb59922d93adad0d990ca302c300c97d332e98accc153c9d6d639506e764413d
SHA512 5b66e88cc88544e2dc9f372edb0fcebedc55de6b28a8cd445888b91c886c11efe39524e3faa861221d5ddf3d45ed190d665d8ef10d5a78b7622cd93d6f41ac96

C:\Users\Admin\Desktop\ConvertFromJoin.temp.id[EC892D17-3483].[[email protected]].8base

MD5 b94a007e61f762dc80222e75d2374c45
SHA1 d2cd349644e6b5e25426b3bfbcdb3bd9b4c94c6a
SHA256 cd30d95521fe9f7ea14022bcce5536271b1ca612d72092619313dc5f4edbd28a
SHA512 72f3384044bf417640d4eaf58ce63722c921e7650acf3c4a23aded53806c763b65f1b384a50ac993dd27aa24ac7050a0a2f00566490acef9a2f416fb50a15de4

C:\Users\Admin\Desktop\DenyExport.pptm.id[EC892D17-3483].[[email protected]].8base

MD5 9e3455837302d2abb3cc1638e3908a31
SHA1 53864c8c027ffb015f511b0188a3f13161d2b3fb
SHA256 131b83f2c521a33db8e45d5a67f15c682fd0a75b9263f6a41da10bcf2e99f6df
SHA512 294b314f5f727e814147e733c337c0543ab2f9aecbb21e77becc1fff83e738e54dcc2efecd5761d152b6154e97eaa3010275ca16ad86fca644340c226da3a016

C:\Users\Admin\Desktop\DisableExpand.txt.id[EC892D17-3483].[[email protected]].8base

MD5 6635172b93af62bf656f9205c65d662c
SHA1 de5988277ac128066a161e3475ee3bd3e5060f44
SHA256 3db3590cf5403ee924a7aaa3c21a621ea9e0e4ec69833a5b6ba4747b37cf715b
SHA512 2c203a30ca6d1735e4a7e0321e7d49c376cb90cd2c8ad5c4baf889cbec807c9ab36bab901e7237b39a1595cb6e909a81815ece8b90b033aecb2503046f66ca3f

C:\Users\Admin\Desktop\EditShow.cr2.id[EC892D17-3483].[[email protected]].8base

MD5 d05877f464c57c9f8472ad4f8436ea1f
SHA1 1a16862620c42a215da15b648491a7a2b330c0db
SHA256 ac87230fa4fafda8c72abb1b46f52dc3f202d666cc5d59f50d87f59e0235a98a
SHA512 728403aade5da44ac5c6f9842ffce1dccc6b5356c33eab9abb53354a4ff66d22a9e28cbfb6358aa3440fe2c00b425b96421fb5d227ecb6e915f11fb8a40fde5c

C:\Users\Admin\Desktop\JoinInitialize.dwfx.id[EC892D17-3483].[[email protected]].8base

MD5 d13c472320d5b90123ac9cdbc4f77552
SHA1 0a7c0e4d0752bf990326ac2cfa5c40e505ff9498
SHA256 ac43083742d94ff1d73dfa8303c6ab887a1fa3fa394e3f3d33df63adc19f3785
SHA512 1bad912795c1175639a0258f4041a42ce60b760d1d17eb785aea5ee399c283dc4f7a407181171dc00038e048bf21d9637c43ad6145174928f2ab0a2866359b58

C:\Users\Admin\Desktop\NewGet.midi.id[EC892D17-3483].[[email protected]].8base

MD5 0ef06ffdba3c7270e795c77a5908702c
SHA1 eb61e0b98e7ae9e96bdaff7e8cfb2d7e0ff128ca
SHA256 aad7f8265a4dddf42391d7914ab4384927f77076619101390a00cd7d26cfe441
SHA512 41885f8d66a66ec43ee8b2df99d5fc01c0fc84952429a55b5b3a4a83c1a109223b64b84aa0cf69c075f470e05c5b594f3bdb72d713e8a866f508265c43756c28

C:\Users\Admin\Desktop\ReceiveStart.bin.id[EC892D17-3483].[[email protected]].8base

MD5 0f116f6482a09c63d65f3640b5c8a48d
SHA1 298e02720fd0597d360206d82bc4ba58b24a668b
SHA256 b81128abe18efb71106cfbdb1c41635fc471c6c2ce1bb7066c793ea2fad9cd8c
SHA512 ea143e0e38c0853690425bb04091c5881c89a689a307624bf2fbbbef77f64c273dfde8eca23c976471dbd520dc87d05187d12b2d7e437279bc8d0f5307258486

C:\Users\Admin\Desktop\SplitPop.xhtml.id[EC892D17-3483].[[email protected]].8base

MD5 e785fcf0466cd4533b5e5ddd92df44e4
SHA1 15076b9fc15cdd1674d3905470b8c12992bb5b02
SHA256 f946b4e4608ea0620eae2669f61619744f5b872251f6c168aae97193c6c759e1
SHA512 d30785af9360c3198465cecbe542f59dd0202a53217a55c4c18bcdd1c132982b1588f50208fe18ce7176e6137c70c44ae694d39834b39e16734f227f42fb0d90

C:\Users\Admin\Desktop\StepConvertTo.dotm.id[EC892D17-3483].[[email protected]].8base

MD5 4d37fea372191b9278ad592cd6d4087b
SHA1 c1368b326fe64ccc93a4207075fd22df15c95011
SHA256 db637ff9f81ba33279e9567c37f15b266b48e53e7bed3e76001ba5accd83898e
SHA512 4b19450107da07aff84924fa6cee57d45c0c798e7aaf4f5f58445911914be31505e089e2b4a802d6d5e6f248eabb6546c941d04006bc835dc4b197c298bb7690

C:\Users\Admin\Desktop\StopConvert.mhtml.id[EC892D17-3483].[[email protected]].8base

MD5 ccbd5b1d693e0858d3a18adee9aa399e
SHA1 4784792ddb5c71a8f9bf683f0a8e54540bb58667
SHA256 b03edaf2bb79c07fa8a65f337ee36095c6ea1b00664703608cdc7ebf3bec5275
SHA512 6e749990084e883da0309e4ae14b33282c8483ed1b5edaa35e17a61fabd9f7158c61f0b0580e391a6d05329b5d414a02fbc019758394cc673066b3017471a7d6

C:\Users\Admin\Desktop\SuspendRepair.m4v.id[EC892D17-3483].[[email protected]].8base

MD5 bd0d8bcc1069f28545144544bf92ed75
SHA1 8c45a6fa0350f840e732c3dc6b36214ae9cd0ab7
SHA256 fcef02f6ed0aba4e1b221f9f09d9395ccc11cbc0f5dbd9f0eeff148720b07ba8
SHA512 221f7c00c66b5d6e2cd00d5eee55e1995211395de99992491e6f32b9214020f05b3d436be064a059d08167e30b4915d5e590ff579df5b25a73d5dc81e3b1e56a

C:\Users\Admin\Desktop\UninstallFind.mpg.id[EC892D17-3483].[[email protected]].8base

MD5 774fca57f3ff371ec54d250c7ff791f4
SHA1 bedae18c6f84a988b3067f2d119c2fd151390631
SHA256 ccea5d2e7fc6fa4e5652a12c7ccbca068f6b3ffd9e898bd754014a66c2daf5c6
SHA512 fb491553b7aa7eb7bb85ee89432bf7ac7d2b736fcb553f80db141e5cce1fc3a8e40820d8d3e0742eddd64fdef7472020ea2265df1ba9c7cbbd91070d8bd2a10d

C:\Users\Admin\Desktop\PingMove.mht.id[EC892D17-3483].[[email protected]].8base

MD5 19e5fae2d4a74d3edae53bd10497724e
SHA1 7772d75a1f87687b19be72d606183f02e1a09771
SHA256 890808b199248c51b7179a16d7ed2c2474c4af7ccf6a5a0e121530a816b63d85
SHA512 0f40e93ba373b93bb002ffdeeb1222ff532bab3cecf9b77fc16e36d051f52496cd347e4241bf3d30b50cb562b6c1e19ba9d77bacca5e269c7c3f7aaeef828543

C:\Users\Admin\Desktop\PopCompare.mpeg2.id[EC892D17-3483].[[email protected]].8base

MD5 69c9c881dc863922929a690f64653263
SHA1 fba8b8d42f10411736e52d160e2501e3e7fe5920
SHA256 80f674e16510d7d10b2c453e78d4e433623b12922ce1febc4581c0a2df11e4c9
SHA512 3725f802133d302e7f5e4f4bcc323c42a31e71dd428d9ba2b7caf7139d4aea23ab5b8c7680884420a0636c53f9307cfc6e0018d77ee2ab7edd0bea425288382d

C:\Users\Admin\Desktop\OpenUpdate.docx.id[EC892D17-3483].[[email protected]].8base

MD5 0db4db382b2833b6effb79cd7fb9a5b9
SHA1 f740310e604841dfd45394cb4c5f970aeb27a9fe
SHA256 b3ae020aa3b61249dffbed564df104fb5d76c2a9eb4095d434034591092f4b25
SHA512 15a5f587a67afcc7aba217ef7f805ee50d23edd8f9dcf5e0b51d3d9c3ca47c83f92a82323d7253aea14ec9faa10b244221d041bbd10aa376a6a6f2fb0b02a23d

C:\info.hta

MD5 52d8fdfe6a03fa0d11a1aa4fe73ed52d
SHA1 2e88b8ad06677509f90d755e8f1094054591e97e
SHA256 7fe0606914d48136a1b88fea478f1c57843b53d3e8d41d22cce4bb0caaad9345
SHA512 f99355e1c1ce51c37065cc4a7d7ad108b0341541118eac281ab0194266beb40c420c25f8ba290ba5f84b92f4aeb6a576ee3c5b469287f70a3a70411649be5174

C:\users\public\desktop\info.hta

MD5 52d8fdfe6a03fa0d11a1aa4fe73ed52d
SHA1 2e88b8ad06677509f90d755e8f1094054591e97e
SHA256 7fe0606914d48136a1b88fea478f1c57843b53d3e8d41d22cce4bb0caaad9345
SHA512 f99355e1c1ce51c37065cc4a7d7ad108b0341541118eac281ab0194266beb40c420c25f8ba290ba5f84b92f4aeb6a576ee3c5b469287f70a3a70411649be5174