Malware Analysis Report

2024-10-16 05:11

Sample ID 230920-ve4d5she5s
Target 4a94bfa09b99674b406eefa0fc0f8c5e.exe
SHA256 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b
Tags
ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor collection evasion persistence ransomware rat spyware stealer trojan bootkit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b

Threat Level: Known bad

The file 4a94bfa09b99674b406eefa0fc0f8c5e.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor collection evasion persistence ransomware rat spyware stealer trojan bootkit

AmmyyAdmin payload

Detect rhadamanthys stealer shellcode

Ammyy Admin

FlawedAmmyy RAT

Phobos

Suspicious use of NtCreateUserProcessOtherParentProcess

SmokeLoader

Rhadamanthys

Modifies boot configuration data using bcdedit

Renames multiple (371) files with added filename extension

Deletes shadow copies

Renames multiple (306) files with added filename extension

Modifies Windows Firewall

Deletes backup catalog

Executes dropped EXE

Drops startup file

Reads user/profile data of web browsers

Deletes itself

Drops desktop.ini file(s)

Adds Run key to start application

Accesses Microsoft Outlook profiles

Writes to the Master Boot Record (MBR)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Suspicious behavior: MapViewOfSection

outlook_office_path

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

outlook_win_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-20 16:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-20 16:55

Reported

2023-09-20 16:57

Platform

win7-20230831-en

Max time kernel

111s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1764 created 1200 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (306) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\l4DTmqz{4W = "C:\\Users\\Admin\\AppData\\Local\\l4DTmqz{4W.exe" C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\l4DTmqz{4W = "C:\\Users\\Admin\\AppData\\Local\\l4DTmqz{4W.exe" C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2F3386PL\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OXRRPXTH\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-86725733-3001458681-3405935542-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\PNLMEYHC\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZM14P5Y5\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2TCNB3QR\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JY0EDUNO\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\87U71MEJ\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-86725733-3001458681-3405935542-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8VE3RER5\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Jamaica.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Status Report.fdt.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153095.WMF.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CONTACT.JPG.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_choosecolor.gif C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryMergeLetter.dotx.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\ext\localedata.jar C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105588.WMF C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SPACE_01.MID C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_COL.HXT.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Linq.Resources.dll C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_sv.dll.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0205582.WMF.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OARTCONV.DLL.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jre7\bin\kinit.exe.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\BREEZE.ELM C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10302_.GIF.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ENVELOPR.DLL.IDX_DLL C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\7-Zip\7z.exe.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OPHPROXY.DLL C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ACWIZRC.DLL.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\RECALL.DLL.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195320.WMF.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\cpu.js C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Sitka.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\promointl.dll.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175428.JPG.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\PREVIEW.GIF C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\FONTSCHM.INI C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_ring_docked.png C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\EMAIL.DPV C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\WMPDMC.exe.mui C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG.id[A1EE4869-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 2188 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 1764 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 1764 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 1764 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 1764 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 1764 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 1764 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 748 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 2804 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe
PID 2804 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe
PID 2804 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe
PID 2804 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe
PID 748 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 2804 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe
PID 2804 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe
PID 2804 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 1988 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe
PID 2696 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe C:\Windows\system32\cmd.exe
PID 756 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 756 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 756 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1976 wrote to memory of 1832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

"C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe"

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

"C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe"

C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe

"C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe"

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe

C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

"C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe"

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\478B.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\478B.tmp\svchost.exe -debug

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\478B.tmp\aa_nts.dll",run

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 moknex158.xyz udp
DE 45.131.66.159:80 moknex158.xyz tcp
DE 45.131.66.159:80 moknex158.xyz tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.153:80 apps.identrust.com tcp
US 8.8.8.8:53 www.microsoft.com udp

Files

memory/2188-1-0x0000000074BA0000-0x000000007528E000-memory.dmp

memory/2188-0-0x0000000000C10000-0x0000000000C96000-memory.dmp

memory/2188-2-0x00000000020A0000-0x0000000002118000-memory.dmp

memory/2188-3-0x00000000049C0000-0x0000000004A00000-memory.dmp

memory/2188-4-0x0000000004660000-0x00000000046C8000-memory.dmp

memory/2188-5-0x00000000047E0000-0x000000000482C000-memory.dmp

memory/1764-6-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1764-8-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1764-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1764-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1764-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1764-16-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2188-18-0x0000000074BA0000-0x000000007528E000-memory.dmp

memory/1764-19-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1764-20-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1764-21-0x0000000000100000-0x0000000000107000-memory.dmp

memory/1764-22-0x00000000020A0000-0x00000000024A0000-memory.dmp

memory/1764-24-0x00000000020A0000-0x00000000024A0000-memory.dmp

memory/1764-23-0x00000000020A0000-0x00000000024A0000-memory.dmp

memory/1764-25-0x00000000020A0000-0x00000000024A0000-memory.dmp

memory/2524-26-0x0000000000060000-0x0000000000063000-memory.dmp

memory/2524-27-0x0000000000060000-0x0000000000063000-memory.dmp

memory/1764-28-0x00000000001B0000-0x00000000001E6000-memory.dmp

memory/1764-35-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1764-34-0x00000000001B0000-0x00000000001E6000-memory.dmp

memory/1764-36-0x00000000020A0000-0x00000000024A0000-memory.dmp

memory/1764-37-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1764-38-0x00000000020A0000-0x00000000024A0000-memory.dmp

memory/2524-40-0x00000000000B0000-0x00000000000B7000-memory.dmp

memory/2524-42-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-41-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-43-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-44-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-46-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-48-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-49-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-50-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-51-0x0000000077AB0000-0x0000000077C59000-memory.dmp

memory/2524-52-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-53-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-54-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2524-55-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

memory/748-61-0x0000000000170000-0x00000000001C4000-memory.dmp

memory/2524-59-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/748-63-0x00000000003C0000-0x0000000000406000-memory.dmp

memory/748-65-0x0000000000510000-0x0000000000544000-memory.dmp

memory/748-64-0x0000000004B10000-0x0000000004B50000-memory.dmp

memory/748-62-0x00000000744B0000-0x0000000074B9E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe

MD5 a4d5cb9bca2d05b1dee2faff0eddae20
SHA1 8d8dade29177d6c5b69b9f4afe6cb0527ac1cf81
SHA256 de12fc947954ab72028cdac54b5455daf449fa27c975d9e431ad87ed4c413a79
SHA512 b0cd3a6589d6f726b99a0796d99a923ee1fc0f2504374af363706857b48c4d926023aa762fd299b7a566c75369f736297b8caad499ad599ad0d2f464ce9002a6

memory/2804-68-0x0000000000A40000-0x0000000000A90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe

MD5 a4d5cb9bca2d05b1dee2faff0eddae20
SHA1 8d8dade29177d6c5b69b9f4afe6cb0527ac1cf81
SHA256 de12fc947954ab72028cdac54b5455daf449fa27c975d9e431ad87ed4c413a79
SHA512 b0cd3a6589d6f726b99a0796d99a923ee1fc0f2504374af363706857b48c4d926023aa762fd299b7a566c75369f736297b8caad499ad599ad0d2f464ce9002a6

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

memory/2696-71-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2524-69-0x0000000077AB0000-0x0000000077C59000-memory.dmp

memory/2696-73-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2804-74-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/2696-77-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2804-76-0x00000000040B0000-0x00000000040F4000-memory.dmp

memory/2696-79-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2804-78-0x00000000004C0000-0x00000000004F2000-memory.dmp

memory/2696-81-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2804-80-0x00000000005C0000-0x0000000000600000-memory.dmp

memory/2696-82-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2696-83-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2696-85-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1932-86-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

memory/2696-92-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1932-91-0x0000000000400000-0x000000000040B000-memory.dmp

memory/748-90-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/2696-95-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1932-94-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1932-97-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2804-100-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/1200-101-0x0000000002B10000-0x0000000002B26000-memory.dmp

memory/1932-99-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\144QX9s.exe

MD5 a4d5cb9bca2d05b1dee2faff0eddae20
SHA1 8d8dade29177d6c5b69b9f4afe6cb0527ac1cf81
SHA256 de12fc947954ab72028cdac54b5455daf449fa27c975d9e431ad87ed4c413a79
SHA512 b0cd3a6589d6f726b99a0796d99a923ee1fc0f2504374af363706857b48c4d926023aa762fd299b7a566c75369f736297b8caad499ad599ad0d2f464ce9002a6

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

memory/1932-103-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1988-106-0x0000000074720000-0x0000000074E0E000-memory.dmp

memory/1988-107-0x0000000001EB0000-0x0000000001EF6000-memory.dmp

memory/1988-108-0x0000000000610000-0x0000000000650000-memory.dmp

memory/1988-124-0x0000000074720000-0x0000000074E0E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\l4DTmqz{4W.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

memory/980-126-0x0000000000401000-0x000000000040A000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[A1EE4869-3483].[[email protected]].8base

MD5 dbce6cd0779870cf5c3c75050383cba9
SHA1 c364a12c964654292ab0948a444919777d408c96
SHA256 1f2a8e2afddc51d470036ddde9c08cfeb95de1d0216f29e408431853f81a01fb
SHA512 06fbd09dc5ed0dec9c5ebe828fac76f4bd230ffccd6cd5933f96183886608bff92dadd8b2b990671b3f730bb39e8af53e9c7728f04f57e90e963af8b5c4cc720

memory/2696-273-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1200-276-0x000007FEF5690000-0x000007FEF57D3000-memory.dmp

memory/1200-284-0x000007FF59DC0000-0x000007FF59DCA000-memory.dmp

memory/2524-376-0x00000000000B0000-0x00000000000B2000-memory.dmp

memory/2524-380-0x0000000077AB0000-0x0000000077C59000-memory.dmp

memory/2848-9347-0x00000000001F0000-0x0000000000265000-memory.dmp

memory/2848-9350-0x0000000000180000-0x00000000001EB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrara2q.default-release\cookies.sqlite.id[A1EE4869-3483].[[email protected]].8base

MD5 fe4db74287e8f4866c4e7c3600f5ee35
SHA1 c7b184ec72b998aae1c0c90e87f53bef88a8b589
SHA256 e364ad91a5477ccef6e83b98cf2ceef17109891c537bcbd852ced351c6a3e4ea
SHA512 640a86dab0911f197dee112a2d2e6c39de1ce033fb77b30f0c3295936da5505de2c3ce86240cb1e799de7e76f15dedcfc1518f7701f269ea88f29d12466f76e0

memory/2848-9413-0x0000000000180000-0x00000000001EB000-memory.dmp

memory/1856-9655-0x0000000000180000-0x00000000001EB000-memory.dmp

memory/1856-9659-0x0000000000060000-0x000000000006C000-memory.dmp

memory/1196-9813-0x0000000000090000-0x0000000000094000-memory.dmp

memory/1196-9854-0x0000000000080000-0x0000000000089000-memory.dmp

C:\Users\Admin\AppData\Roaming\adrbvve

MD5 a4d5cb9bca2d05b1dee2faff0eddae20
SHA1 8d8dade29177d6c5b69b9f4afe6cb0527ac1cf81
SHA256 de12fc947954ab72028cdac54b5455daf449fa27c975d9e431ad87ed4c413a79
SHA512 b0cd3a6589d6f726b99a0796d99a923ee1fc0f2504374af363706857b48c4d926023aa762fd299b7a566c75369f736297b8caad499ad599ad0d2f464ce9002a6

C:\Users\Admin\AppData\Roaming\fdvusga

MD5 988027a5bb564cff855145a254420e7e
SHA1 e316075075e446162661c66dca8bfdaf92290f38
SHA256 973a6ee6c4f9533f298f41458e66a6462384bf2d9363bec2e462a8b076e49b5d
SHA512 d4e5c1acd8c905065c3d029472a7cf2747fe137d2397bcf4e7f7ea6a85f441f643dfc2606ba9ed21b5b54913f90c3d8d54ad959dcb72ead92278b0550b8d6ea0

memory/3044-10184-0x0000000000080000-0x000000000008B000-memory.dmp

memory/3044-10171-0x0000000000090000-0x000000000009A000-memory.dmp

memory/3044-10185-0x0000000000080000-0x000000000008B000-memory.dmp

memory/3060-10247-0x0000000000090000-0x0000000000097000-memory.dmp

memory/3060-10248-0x0000000000080000-0x000000000008B000-memory.dmp

C:\Users\Admin\Desktop\WaitRedo.vbe.id[A1EE4869-3483].[[email protected]].8base

MD5 5152c907c64a722c28d75beea0509c8f
SHA1 bbf6ea7e5cc08dbe43ec6f9fffd569c90a7e4d2d
SHA256 474cfe54679a46edae86e1e1e3ecedcaf71a7d82900907120b914abd873e62ac
SHA512 651aaf02e93ddfffdc55093b45509c080b58330cdfc20385ad37905bd007ea960223f2458695106558823486fefcf66b787f6ede1c407290995ba762426e42be

C:\Users\Admin\Desktop\ApproveWatch.wdp.id[A1EE4869-3483].[[email protected]].8base

MD5 a30a34d72d9aae8298db56d89995c338
SHA1 c4b8a9df1dd2ef1f47e3ae924cffb5c771b4abfe
SHA256 21821a3b92ad8a7d5048e1ab4e8df1b6bca6c66224ec2ef239643fbadaf0d392
SHA512 0544f8bed2444367b8110bfb102793b74259119dddfc5a93aef46bce54d5ce02c516a1c7405a78570840fab88a52516a5d66a1350bebbd71f2506fa3bd51ebe8

C:\Users\Admin\Desktop\ClearConvertTo.vst.id[A1EE4869-3483].[[email protected]].8base

MD5 c741793def722131d86331245240b808
SHA1 1b0578a3dc745b549d311a57d82d3889af2f8806
SHA256 16dcaa5917ee48ff4e0a6b43a743d88531c91266b351150a5a31e3f280d66ee0
SHA512 4810ba252900de3466e85aeb50b4669a02185a25e47686dcbf46eda506b0ef1955e554f4c33e4fa09b44ec9fc26e90b1ea9db71ea84c2daada43f2be4190f827

C:\Users\Admin\Desktop\ClearEdit.wpl.id[A1EE4869-3483].[[email protected]].8base

MD5 1e48c890946ab0e631cae7dfd8e0c043
SHA1 f3b0915f3615b801218b04cbdb80b7d16ba5878e
SHA256 1cefdaf14b384c077c3418a9221526c7dfdc264b08b810b9d669e9108fd7f197
SHA512 c732b6e937a47056e9a044b8708631ec15a058770fc01832dc6ca4b161819b07edaee4a28aff1947d8c0f6d02ef934a551d45ef97e7ea51114b71c888888f5d2

C:\Users\Admin\Desktop\ExportWrite.shtml.id[A1EE4869-3483].[[email protected]].8base

MD5 b467e5f241aa5ec6683f5b973d528fed
SHA1 062ffbe2122cfdbf338da1238af7bc78e873b035
SHA256 4b5c823e84071620084d1710d4dbb4e11fc6eb7f157dc6f977ffaf60238bce1b
SHA512 c525536c5a39e6feab0d88bb932e65bc99744547ccfc4623126aac1134cc6f246a9593b6b5c499c568c55d5b0ff18a954488df4dff685f5bcc3c96d6ee12bfd7

C:\Users\Admin\Desktop\GetBlock.aifc.id[A1EE4869-3483].[[email protected]].8base

MD5 b6ef84406347b238ab96311354c48598
SHA1 21010ca6ba3d608f3c518ab0a2b3672fd99721b2
SHA256 4254ed40f9fceccaee629ad7b343468931646a0a8ab87936dea784df5b755e19
SHA512 6bd1f4b3ec659f66699eb7e9013a9e81b11845e58210c2a5c942eaf571fac614f67befa157761387ccd94a5a99766a5648b88882500c3fd63895b9549c857137

C:\Users\Admin\Desktop\GrantOut.otf.id[A1EE4869-3483].[[email protected]].8base

MD5 16c3f040a11c195de7d455fee64cb12f
SHA1 d005d4301569120e6408237bff32b7a91de23c85
SHA256 73010f9d4378310de919cc4ba52bd95976430ac65d3c561b9c900f75821655cf
SHA512 26b7be6a88b7af11ffddd3b9ac79379e4ff68026658ad2f9fb76e9b96349a1da33f6c1559b5281a729d41638fa329cbb09d5817b70ba2aa17401923e006b6370

C:\Users\Admin\Desktop\InitializeDebug.rar.id[A1EE4869-3483].[[email protected]].8base

MD5 b80cee422fddee56d94cfe80eaeea2cb
SHA1 af1df3c36d1e2dce1e03194eda7a92df28f26ad4
SHA256 0dc6fec06079e9c1cb7047e0cc3de6f44ca8b268386c645d35ab6a4d81c24d05
SHA512 f559be89b8b5d7eecbe51dde8a68e7ee7446d7dc741a82dddb6993aea089b44f891d8f9f388827cb8e81fd7b80d93416fc038526578903001055fa65ff744118

C:\Users\Admin\Desktop\MountHide.MTS.id[A1EE4869-3483].[[email protected]].8base

MD5 df825fbb6560355551a8ee871306a8c7
SHA1 6cc531d73f385b26680af37131a2e4beb0816cdc
SHA256 7cc6ce2720f3a0466e3eb93d1abd29b3e469b124fa8af3b0e68e84048366fb10
SHA512 69d82143a67b57a9449f14364b17e6c6ce2b73d5af3cec43546ab36e996217d46ef1f91901fcda04f09bd2f72966b36a974ee368439fdc9fb81a80f9bcf4eae7

C:\Users\Admin\Desktop\PingRestore.mov.id[A1EE4869-3483].[[email protected]].8base

MD5 a6e51d999dd0ef852fd4609d2dcb2fba
SHA1 098e0b5633222bf824a13baf17211c7ad3a523ec
SHA256 27157502b5776bc6a1d09d7a3f62082a7778326b45917a9b5a860eb0ccb130a8
SHA512 ba639564b3278be73df2d419c4236436d169c472dfb620bb8c2e705631a862179bae9dd1a1837a3e75a0af8a98f858fadb7f987e489a2fad52156a2d8a282544

C:\Users\Admin\Desktop\PopReceive.wax.id[A1EE4869-3483].[[email protected]].8base

MD5 09776aa24bc1a7102a5f69ff99bb2478
SHA1 5a5aca358b9bce9d0e6248c2e6ec6dd1ad03f05a
SHA256 9e3b5646746ddccce96a62ff3d9a1d0b2f72186f885e25e53d2a17bcb5746f0e
SHA512 3e1002da20171f39f308fdd7d6f6d26475b2ffa808e5b2acf48817778a7d5f607d9c8ea358049f0d64721ff83650686eaca949f403d69640b14e10c4adbe171a

C:\Users\Admin\Desktop\PopStart.midi.id[A1EE4869-3483].[[email protected]].8base

MD5 b4cececf7b9c136c5134d4c037b9b292
SHA1 2a4019443bc5777f4bad63f12bcb3965b638b1f2
SHA256 72fdec8f7d6559bd0d34af2148e413ba566e6b4cd7134e6df0f0b849c63acecd
SHA512 e2e35c045c9159102b8b36b4d454904350d10bf40475236bbff8e5c09eef074cd8403b072d3b0e00d428d5414cdcf34e205a4af04b4674d6ac6255314c4744c7

C:\Users\Admin\Desktop\PublishUpdate.jtx.id[A1EE4869-3483].[[email protected]].8base

MD5 5a59729b9348d80d02659f7f44dab85a
SHA1 9b98b9246bcaec772bc73a370674960fb4d5b682
SHA256 c18c8bf4ea1ad25fc8663e924a0d9fd776dccb800edffbe77dae929fbec885da
SHA512 c82a227293c8e801873227221378b4261689ed6acffebfee3e31fb5d6a58791064c2f16edd5923b5eca36781eef78d6e47446d42f1df437f98cf0efba950776c

C:\Users\Admin\Desktop\ReadLimit.rar.id[A1EE4869-3483].[[email protected]].8base

MD5 43fefdedf1fa9769a4afcfe57dbfc852
SHA1 9bc387be60e5170a59366c1e2450d0d1f8a74388
SHA256 bfded70fc72e4017ea5e16ada413bf2b82cca68288ce8a664912790ab08e62d4
SHA512 62869927a2fc9ce61ea493fb00990e1c487f39f1f43bc24c2dc8d1b6be6a3d9cb2074f83b4bd25364adf49362c25ae6e26914d5ce5934de2ad10f51ca510da59

C:\Users\Admin\Desktop\RedoRepair.dwfx.id[A1EE4869-3483].[[email protected]].8base

MD5 60fcf8a1645e99f5acf61c2dcb307118
SHA1 c0f20d9092155a80d610376a3160eb2af4bf0ba6
SHA256 b1537f412a47f6ff428ed9e02dd4a4f94d2f203f88de684d43488ed409c3dd23
SHA512 cda3a7253652c488154859c8f73dd406d4f02593880cf95c618a2f0b679202168e3d58836de9af7aa5510d20799a402645f77190e15c2c2d402ac886c0032b4b

C:\Users\Admin\Desktop\RepairProtect.docx.id[A1EE4869-3483].[[email protected]].8base

MD5 fe04ed7660de9ae78c0510daf402b2f3
SHA1 059016ebbac9df3fa73f804fffd49c080d8a86be
SHA256 98fd54c006828190962035ca6d5d3f40d02c588df4b08a0e5bd5b4eece38419c
SHA512 ec3984c4c295f061c44f1da00e5e0036842ce885ec971de55c26f4e3f2028e4908e98f5cf8799a17704dbe0b36c349417ebe734a8ab0d496ff1f9185588c8100

C:\Users\Admin\Desktop\RepairSelect.mp3.id[A1EE4869-3483].[[email protected]].8base

MD5 8e2dd9cdb787efdc8d2bd0139947d89c
SHA1 670ffc134aefececb6e4af84136e49d2ae68a12b
SHA256 5941762e9cc14f120135ff297c838168c9d471760442ae98b36a5df434a6cebd
SHA512 aae324eaac4e3a99d0cd253e1f69c62209fb71caeb850ec614115b10265e9c7b296d7795201dc568a9d7d8cecc62aa25742becceb95101a93afa788b0b255775

C:\Users\Admin\Desktop\ResetConnect.png.id[A1EE4869-3483].[[email protected]].8base

MD5 f61b191ce5fcd0a60d6c3ee6fa0f62ac
SHA1 63a0ba45888d03cf6376143f7f567a0ce3ff7686
SHA256 f5d90f589e644e1568d3626d17d56b0cb6f8950b536f44d5a839b4c3434f2c6d
SHA512 0f5fb60deeb7c65db258239590dde90c9850857aea06eefce5dbd7cc4434e3758b3671f7b6cd7f227f08bfc149132b5c92c643680af26192aeb088770cd9d323

C:\Users\Admin\Desktop\RestorePublish.ogg.id[A1EE4869-3483].[[email protected]].8base

MD5 bdd514e62c26a3729d637007ce6ac042
SHA1 d57d0aa2679555a60dacd8843e159cc23fb01e64
SHA256 7b888ced0d0cb1a1146479abc515000c4fa44275c25f6accf1594d68265fb53d
SHA512 8d8c0bbc55bc56797296a40d791c37a4e465bd400986df9754ff015ccde351a227a360d4de53572fbe19d013a2a8b71df3bfad107a63ff0dde98e21f17ac9c9c

C:\Users\Admin\Desktop\SelectOut.jpeg.id[A1EE4869-3483].[[email protected]].8base

MD5 358fcf4b271dfa85deadb77a4f9affb3
SHA1 09d04b9eff3c5a28ed893ccff73604a4b3659844
SHA256 868e9e889b0897138b410844d46c4cc2ca065a1645ea4d9e2fcb8111fc4f231e
SHA512 692bbde367784a4fc8b5f1c360c1084a2ee2c809948c3b264938c7d19547d4d40f0afe49b78757c14f9ed2489f782dda776dd4050dcae272e10c7b9cca491b26

C:\Users\Admin\Desktop\SendUnregister.TTS.id[A1EE4869-3483].[[email protected]].8base

MD5 92aa1a51cb1f1294bcb81ae7ff335651
SHA1 740e773d1ba409dfd901b38783debfb597b77b55
SHA256 4e401083cc8528c6bff81a27a743b484af88b38a16b19b1eb23515e4b6d44270
SHA512 c5c976e801e6f0dc81f686c0bea22d599ad55e49366781490d2656da5a19e54ff44a1d58c7f6eda479b8f9f04f14ebf61c6325f29021fcd56593b93b9d725a75

C:\Users\Admin\Desktop\UninstallDismount.rtf.id[A1EE4869-3483].[[email protected]].8base

MD5 30f674530e5f1fecc971ccb363ace4e8
SHA1 c0b395dcc8e00b39039c92c58fe51f501e90a187
SHA256 a5c06294e51e9954db9ea7c61457a4084ab9f8e3f68cb1d9db573e0bbb5eea07
SHA512 ec0bdbf26ebd0c4785892511d31d462ecd2ee64978228ede4ad06920eeb1ef4a61cf6e913ea20bc5aabd0a7109f3959a80711c0e77c93b8d475eea86beb13d6a

C:\Users\Admin\Desktop\UninstallSearch.tif.id[A1EE4869-3483].[[email protected]].8base

MD5 0d16ef62f8f00e879d0828b348fe0dfc
SHA1 c1dd99a40452e21a16bdd3006acbb6b224150421
SHA256 530baf033106c048081fa3b6446a7354057cfb6ec16b6e984e9183a31d9bb603
SHA512 9e2a8d4161e6021ba2356fec3256ceac9754b769b23e7ad242862276383a833ea06999da62a099e92345c032e28b412d6a511ef69c6828530bf460c0d422778b

C:\Users\Admin\Desktop\UninstallStep.clr.id[A1EE4869-3483].[[email protected]].8base

MD5 378b048722211c833178b40d56f0e04a
SHA1 4ec53e7829cffa6272208eb7d3687057904036ed
SHA256 7b9e781202ed8ee5c9ebea57db52a241578dd10c91dab8719252b70f1532988a
SHA512 9d91935803914d18834f16ae216128410f39a78f9c84c68b4f5d91459de90840babd89e852f6d317b217761adc784e0876232120dc193920925e0fba9a2ec149

C:\Users\Admin\Desktop\UninstallWatch.clr.id[A1EE4869-3483].[[email protected]].8base

MD5 da76d548b44d3601c9be4b1637c54b61
SHA1 e32ad615ce27fd7b9725bbb0410c517fc7e74187
SHA256 c85736efaaec003b37ea42ebc7755afa7e5682bcd03891e03f3c44314e592ecf
SHA512 95d732ab97ec65bccc28eaf588c2c04f5e494447eb300038a618ea12a6e198a16ebdc58cbed3cfe034db2576bef39e619f88f96c217d326aeebcd72afa69f478

C:\Users\Admin\Desktop\UseShow.3gp.id[A1EE4869-3483].[[email protected]].8base

MD5 78e87c901fd92b6f489aef05d21e6913
SHA1 7ea9cd79d7dcd213621202c7604467c22db3a826
SHA256 d975816266aa546465e00f047679db8584686500d974bd811f27c6f193a9713c
SHA512 1c9eb22e4db9ff5782a84ce0ba0a5ae4d4936f824c759b7b04842a6658dcf4c49c23dd678b9c9ec1461caf97f6403e99805127e192601a18642439c140bb37d6

C:\Users\Admin\Desktop\DenyEnter.docx.id[A1EE4869-3483].[[email protected]].8base

MD5 c72c7ef0910b75a2b0c3e8d22842c749
SHA1 352ff70812f4e540d5b04a8eeabc1026803819cc
SHA256 85e1abf16d96e8d6ac5590a58fad842791e1b47c572f7bcece3a10074bbd4a37
SHA512 2470b0141506ee164d8925a11b18ab65f2008ece30269822d797eb8c6266d628826ac0de7139aae74a4740fcc4958205e00df3490b74c3a17f28e73ccaf55071

C:\Users\Admin\Desktop\DisconnectCheckpoint.pps.id[A1EE4869-3483].[[email protected]].8base

MD5 4fbb76d34ed0edeeb526334cc3fcb87e
SHA1 3dac1a5815a4c96aa56a60a460e5c538bc129244
SHA256 cd4f8f2e34ecb657f597eb4400b97b511c2aa8455336f45a09616fc51400adf9
SHA512 02056626183a725a751709a11cfce044e94728f81213878efcd224e8e3d4743951acb8cf9b717d061fc3f9baa65c6c1fb98b955ab2080b732c2959b571b91975

C:\Users\Admin\Desktop\EnterInstall.js.id[A1EE4869-3483].[[email protected]].8base

MD5 333ab36b1497932ad1c7fb3c8c0af2c7
SHA1 88289f0099330af22e961f4eecbccf9aa00cc24f
SHA256 a454d4b48a3ec5113bc6f1c5c1978813c4fdbb030f060b6e45460790386ea3ed
SHA512 ded01235128f33a37d243658dbd46b41aa37058ec55729a667d8c8284bb0084a865eaed91774c96734209783b9126c37f003a9d9889038cfe3808c0412fe911b

memory/224-10490-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2544-10384-0x0000000000060000-0x000000000006F000-memory.dmp

memory/2544-10342-0x0000000000070000-0x0000000000079000-memory.dmp

C:\Users\Public\Desktop\info.hta

MD5 4195b3bc0546cd26306a07aa7bf9e5a2
SHA1 0c6d5507fc881c9472e941f1f241ff4cad4108c7
SHA256 b8806f0d6d0cd00a0ef4889e0f2bc7c88de3827dbe6ee5e6b9d6abe3236f3e9e
SHA512 e0490d6e8aa1735349a56290c8b63471fc07900009bc284d6e3c73db9fde99e00baea0bf7e3113aae84a3ebed2a08c84bd45783e227b33043916fc6e95762671

C:\Users\Public\Desktop\VLC media player.lnk.id[A1EE4869-3483].[[email protected]].8base

MD5 6cff1f745d6999a5d18553a0bdcb1051
SHA1 a2a861905b698396e2da33fc703b367e9aa98fb9
SHA256 5940cd701612d5af65678e582c5c8a0e55e18e4c62414c80363f18c2c4cf133e
SHA512 844511d526c235f220955e9905d37529534be9e294c69d9bda472e331d5aac9dea376167cdf83fc7a2f4d4e832ec7897faedd52cd15b21c590c094d27cf9a3fe

C:\info.hta

MD5 4195b3bc0546cd26306a07aa7bf9e5a2
SHA1 0c6d5507fc881c9472e941f1f241ff4cad4108c7
SHA256 b8806f0d6d0cd00a0ef4889e0f2bc7c88de3827dbe6ee5e6b9d6abe3236f3e9e
SHA512 e0490d6e8aa1735349a56290c8b63471fc07900009bc284d6e3c73db9fde99e00baea0bf7e3113aae84a3ebed2a08c84bd45783e227b33043916fc6e95762671

C:\Users\Admin\Desktop\info.hta

MD5 4195b3bc0546cd26306a07aa7bf9e5a2
SHA1 0c6d5507fc881c9472e941f1f241ff4cad4108c7
SHA256 b8806f0d6d0cd00a0ef4889e0f2bc7c88de3827dbe6ee5e6b9d6abe3236f3e9e
SHA512 e0490d6e8aa1735349a56290c8b63471fc07900009bc284d6e3c73db9fde99e00baea0bf7e3113aae84a3ebed2a08c84bd45783e227b33043916fc6e95762671

C:\Users\Admin\Desktop\info.txt

MD5 785cafecedf21b32589f303a8a490a6a
SHA1 5388d3b2a40734142918364eadc02b4429d856e3
SHA256 e455b6bfe96488ca6d4ee70ef495c8925040d22a7cba422e0db7469065daf932
SHA512 4511937134dd7809e888f9bcfcf06d24c17a06f55b5a2b9690a381fda8de9cb793a9799c91814ce43f47ca6db594b010c5feae8aff08bd3edd448967d06fc93b

C:\Users\Public\Desktop\Google Chrome.lnk.id[A1EE4869-3483].[[email protected]].8base

MD5 cb290ffae818b00c158cf81cffd1421a
SHA1 ef36b7acf0798b1c3cd560b3836515c2d9df4f73
SHA256 0a1f64a63c01aae23db8c3e96d106110883d308e225e3aaea59f0e6340afa729
SHA512 6714db448c27da164c22191b186b158393cccd57f2aa07ab0a9f18555db988ab26894c365847b310feb820658054e0971d852038117d6e84a21dd70f53617b7f

C:\Users\Public\Desktop\Firefox.lnk.id[A1EE4869-3483].[[email protected]].8base

MD5 b3a7aaa79e38e3c8d491c25748c1db7a
SHA1 eb4c225b21a192d0f16400aa778433a92b0e5d03
SHA256 ce1350dcac6732300378ae2128e6be5994e61c251618b13a785a4b0dda304a82
SHA512 6971b42845175f978caec9b37982ab17b8d65ba8c0a8534bc48bb02e154f19a13925d9dece914d73b478d37034cde462eba14eb6b939f84cc7788b082c540d14

C:\Users\Public\Desktop\Adobe Reader 9.lnk.id[A1EE4869-3483].[[email protected]].8base

MD5 91739402509d737d3721e020b9cd82b7
SHA1 42ac7c58be7263f5b1b878f7c6cba413b20ba6ab
SHA256 38ed7b5e9af430b31990a9211dec834a4e0ab4da4bbbd7cb5c078c78647e1c80
SHA512 18cebb9c717a5f14d911bc8f8890c2aae747b57c0cbfcb5d69f23a3acdc084b1933584e7c588f7c4616558a8039bd2d6fc1b786153c440a0b67797c00909fbee

memory/2704-10534-0x0000000000070000-0x0000000000076000-memory.dmp

memory/2704-10536-0x0000000000060000-0x000000000006C000-memory.dmp

F:\info.hta

MD5 4195b3bc0546cd26306a07aa7bf9e5a2
SHA1 0c6d5507fc881c9472e941f1f241ff4cad4108c7
SHA256 b8806f0d6d0cd00a0ef4889e0f2bc7c88de3827dbe6ee5e6b9d6abe3236f3e9e
SHA512 e0490d6e8aa1735349a56290c8b63471fc07900009bc284d6e3c73db9fde99e00baea0bf7e3113aae84a3ebed2a08c84bd45783e227b33043916fc6e95762671

C:\info.hta

MD5 4195b3bc0546cd26306a07aa7bf9e5a2
SHA1 0c6d5507fc881c9472e941f1f241ff4cad4108c7
SHA256 b8806f0d6d0cd00a0ef4889e0f2bc7c88de3827dbe6ee5e6b9d6abe3236f3e9e
SHA512 e0490d6e8aa1735349a56290c8b63471fc07900009bc284d6e3c73db9fde99e00baea0bf7e3113aae84a3ebed2a08c84bd45783e227b33043916fc6e95762671

memory/1196-10547-0x0000000000090000-0x0000000000094000-memory.dmp

memory/864-10548-0x0000000000060000-0x000000000006C000-memory.dmp

memory/864-10549-0x00000000000C0000-0x00000000000C9000-memory.dmp

memory/1716-10551-0x00000000000F0000-0x00000000000F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\478B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\478B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\478B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\478B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\478B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar968A.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 bde95da4e865d6ff9bed1771e1aed4ca
SHA1 95eecc737f654872913b980bdcdd901cac83aa1f
SHA256 41098c56b6a526fa7dd7aa1b434b2bd46d38daa5ce1d410603fa1bba124d91e6
SHA512 ba80139b4341e22e198b909691ab09bfdde6bfe5b6671be52ed073cdedb00ad929a32d2ce7a9ff51e15eff239360856c0c330db55f54c8cc0c2b6aa4dd726650

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 108c76248e75ae671a0973addc2bf2f2
SHA1 4b616c040a8f6b21d9a47a0fd815edbad5e3e330
SHA256 560dfa82bcfcbee5a6455bd73f297a4ba7bb0ae4ca93723f981b617652fb1bde
SHA512 960be07d43aece6cb848f33ceac0c27285f60b49ddb0796918a33f8d77bd443b9286792f9e526e00a5e340139da318a1d5278712a5bb7ac18db6adc93b8a3a10

\Users\Admin\AppData\Local\Temp\478B.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\478B.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\478B.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\478B.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\478B.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\478B.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-20 16:55

Reported

2023-09-20 16:57

Platform

win10v2004-20230915-en

Max time kernel

145s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4392 created 3240 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (371) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0{Q = "C:\\Users\\Admin\\AppData\\Local\\0{Q.exe" C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0{Q = "C:\\Users\\Admin\\AppData\\Local\\0{Q.exe" C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1574508946-349927670-1185736483-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1574508946-349927670-1185736483-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\5CB8.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\InitializeDeny.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\splash.gif C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-250.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FirstRunMailBlurred.layoutdir-RTL.jpg C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sqlpdw.xsl C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.WebSockets.Client.dll C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\oregres.dll C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Excel.dll.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\MedTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\13.jpg C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\SensorFusionLib.dll C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\textinputdriver.dll C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-48.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected][97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-250.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview_selected-hover.svg.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-48.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp4.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\mip_core.dll C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-32.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\VideoWhatsNewItems.json C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations_retina.png.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nothumbnail_34.svg.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.id[97E299BF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5CB8.tmp\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3992 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 3992 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe
PID 4392 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 4392 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 4392 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 4392 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe C:\Windows\system32\certreq.exe
PID 2596 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2596 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 4912 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe
PID 4912 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe
PID 4912 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe
PID 4912 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe
PID 4912 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe
PID 4912 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 3464 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe
PID 2120 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Windows\system32\cmd.exe
PID 2120 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Windows\system32\cmd.exe
PID 2120 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Windows\system32\cmd.exe
PID 2120 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 5076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4236 wrote to memory of 5076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5028 wrote to memory of 812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 5028 wrote to memory of 812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4236 wrote to memory of 2112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4236 wrote to memory of 2112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5028 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5028 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5028 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5028 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5028 wrote to memory of 4184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5028 wrote to memory of 4184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5028 wrote to memory of 2172 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

"C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe"

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

C:\Users\Admin\AppData\Local\Temp\4a94bfa09b99674b406eefa0fc0f8c5e.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

"C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe"

C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe

"C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe"

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe

C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

"C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe"

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\5CB8.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\5CB8.tmp\svchost.exe -debug

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 moknex158.xyz udp
DE 45.131.66.159:80 moknex158.xyz tcp
DE 45.131.66.159:80 moknex158.xyz tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp

Files

memory/3992-0-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/3992-1-0x00000000000F0000-0x0000000000176000-memory.dmp

memory/3992-2-0x0000000004C10000-0x0000000004C88000-memory.dmp

memory/3992-3-0x0000000004D00000-0x0000000004D10000-memory.dmp

memory/3992-4-0x0000000004C90000-0x0000000004CF8000-memory.dmp

memory/3992-5-0x0000000004E10000-0x0000000004E5C000-memory.dmp

memory/3992-6-0x0000000005460000-0x0000000005A04000-memory.dmp

memory/4392-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4392-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4392-11-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3992-12-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/4392-14-0x0000000003180000-0x0000000003580000-memory.dmp

memory/4392-13-0x0000000002FE0000-0x0000000002FE7000-memory.dmp

memory/4392-15-0x0000000003180000-0x0000000003580000-memory.dmp

memory/4392-16-0x0000000003180000-0x0000000003580000-memory.dmp

memory/4392-17-0x0000000003180000-0x0000000003580000-memory.dmp

memory/1996-18-0x0000021C5BE50000-0x0000021C5BE53000-memory.dmp

memory/4392-19-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4392-20-0x0000000004010000-0x0000000004046000-memory.dmp

memory/4392-27-0x0000000003180000-0x0000000003580000-memory.dmp

memory/4392-28-0x0000000003180000-0x0000000003580000-memory.dmp

memory/4392-26-0x0000000004010000-0x0000000004046000-memory.dmp

memory/4392-29-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4392-30-0x0000000003180000-0x0000000003580000-memory.dmp

memory/1996-31-0x0000021C5BE50000-0x0000021C5BE53000-memory.dmp

memory/1996-32-0x0000021C5DF00000-0x0000021C5DF07000-memory.dmp

memory/1996-33-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-34-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-36-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-35-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-38-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-37-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-40-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-41-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-42-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-43-0x00007FFC4ED90000-0x00007FFC4EF85000-memory.dmp

memory/1996-44-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-45-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-46-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-47-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-48-0x00007FF4D7FC0000-0x00007FF4D80EF000-memory.dmp

memory/1996-49-0x00007FFC4ED90000-0x00007FFC4EF85000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe

MD5 a4d5cb9bca2d05b1dee2faff0eddae20
SHA1 8d8dade29177d6c5b69b9f4afe6cb0527ac1cf81
SHA256 de12fc947954ab72028cdac54b5455daf449fa27c975d9e431ad87ed4c413a79
SHA512 b0cd3a6589d6f726b99a0796d99a923ee1fc0f2504374af363706857b48c4d926023aa762fd299b7a566c75369f736297b8caad499ad599ad0d2f464ce9002a6

C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe

MD5 a4d5cb9bca2d05b1dee2faff0eddae20
SHA1 8d8dade29177d6c5b69b9f4afe6cb0527ac1cf81
SHA256 de12fc947954ab72028cdac54b5455daf449fa27c975d9e431ad87ed4c413a79
SHA512 b0cd3a6589d6f726b99a0796d99a923ee1fc0f2504374af363706857b48c4d926023aa762fd299b7a566c75369f736297b8caad499ad599ad0d2f464ce9002a6

memory/4912-57-0x0000000000F30000-0x0000000000F80000-memory.dmp

memory/2596-58-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/2596-56-0x00000000002A0000-0x00000000002F4000-memory.dmp

memory/4912-59-0x0000000005830000-0x0000000005874000-memory.dmp

memory/2596-60-0x0000000004C40000-0x0000000004C86000-memory.dmp

memory/4912-61-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/2596-63-0x0000000004D70000-0x0000000004D80000-memory.dmp

memory/2596-62-0x0000000004C80000-0x0000000004CB4000-memory.dmp

memory/4912-65-0x0000000005900000-0x0000000005910000-memory.dmp

memory/4912-64-0x0000000005A10000-0x0000000005A42000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

memory/2120-68-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-72-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

C:\Users\Admin\AppData\Local\Microsoft\JD79{Pfg.exe

MD5 a4d5cb9bca2d05b1dee2faff0eddae20
SHA1 8d8dade29177d6c5b69b9f4afe6cb0527ac1cf81
SHA256 de12fc947954ab72028cdac54b5455daf449fa27c975d9e431ad87ed4c413a79
SHA512 b0cd3a6589d6f726b99a0796d99a923ee1fc0f2504374af363706857b48c4d926023aa762fd299b7a566c75369f736297b8caad499ad599ad0d2f464ce9002a6

memory/2192-73-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2120-74-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2192-77-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2596-78-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/4912-79-0x0000000074AF0000-0x00000000752A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0{Q.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/3464-82-0x0000000074B90000-0x0000000075340000-memory.dmp

memory/3464-83-0x0000000005760000-0x0000000005770000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\0{Q.exe

MD5 6ed7b74cc62ec5c085f97373348d5bc0
SHA1 279b8f4f87be08afa2debe4b1c11a4b0738eefcf
SHA256 2a270618cf65fcfb6476269b7c7bdbae84552d15a3da3e8907425e20ace4548a
SHA512 417975b9ea6ed0fb9971e1ac4338cf9b2929ba0800345f7bc51207bb4addb90a55bf81819c129061c54dfdb29d14a6603955c81e46b6831a1cc9666ce5b239a8

memory/3464-88-0x0000000074B90000-0x0000000075340000-memory.dmp

memory/2696-89-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1996-90-0x00007FFC4ED90000-0x00007FFC4EF85000-memory.dmp

memory/3240-91-0x0000000002610000-0x0000000002626000-memory.dmp

memory/2192-92-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2120-105-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-106-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-107-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-109-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-113-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-112-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-120-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-124-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-114-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-128-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-144-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-143-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2120-167-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[97E299BF-3483].[[email protected]].8base

MD5 04e0fd3be5a94692af69db17cc0bb167
SHA1 5c18577e0593ae433f0d64082f1d315554be1b57
SHA256 3451389e93ee2fd4e6edc3f855256c8b8944f5d4dc1c1c03abe17cc5c360fa6f
SHA512 7cadb0d30d2ba7ec78d53e16e820aae038d4b81fb3361192907e2e6ec5a1efbdbfab2d09c37e0ebdfeb7a1173ceb0c32ff0b5d8dca0a4a595f05031a0b00c9d9

memory/3240-5732-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5734-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5736-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5739-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5742-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5741-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5743-0x0000000000850000-0x0000000000860000-memory.dmp

memory/3240-5745-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5746-0x0000000000850000-0x0000000000860000-memory.dmp

memory/3240-5749-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5750-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5753-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5755-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5756-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5757-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5758-0x0000000000850000-0x0000000000860000-memory.dmp

memory/3240-5762-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5761-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5764-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3240-5766-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/3404-6233-0x0000000000C10000-0x0000000000C17000-memory.dmp

memory/3404-6250-0x0000000000C00000-0x0000000000C0C000-memory.dmp

memory/3404-6257-0x0000000000C00000-0x0000000000C0C000-memory.dmp

memory/3456-6373-0x0000000000D30000-0x0000000000D39000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\cookies.sqlite.id[97E299BF-3483].[[email protected]].8base

MD5 7af844df30961f764a6b4b3009e42f6f
SHA1 0fb80c83655d0feae652ff5d07e3c8a921e81c3c
SHA256 5f6493bd94b3b5c3d03106ac632645cb66cc752e48cea1badeedbf2aa14f90a1
SHA512 0c17a1c14cc665f71c8304c3960fe0efd6908b9c31b3c7e99b40e9cdb6218ece086b4d4ab346d8b4ed0f5802851597ffe79aa8907274e16a50d565575d02b210

C:\Users\Admin\AppData\Local\Temp\5CB8.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\5CB8.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be